Skip to main content
Glama
Albretsen

MCP Emails

MCPEmails

Give your AI agent an inbox. A hosted Model Context Protocol server that lets Claude, Cursor, or any MCP‑compatible client read, search, send, organize, and schedule email through your existing mailboxes — without ever storing your mail.

Connect a mailbox once, paste one URL into your agent, and it can work your inbox live. Email is fetched on demand and never retained; credentials are encrypted at rest and decrypted only at call time inside an isolated edge function.

🔗 mcpemails.com · 📚 Docs · 💳 Pricing


Contents


Related MCP server: commune-mcp

How it works

  1. Connect a mailbox. Sign in at mcpemails.com and connect Gmail (one‑click OAuth) or any IMAP/SMTP account (app password). Credentials are encrypted with AES‑256‑GCM before they touch the database.

  2. Get access. OAuth‑capable clients (claude.ai, Claude Desktop, Cursor) connect in one click via OAuth 2.0 + PKCE. Everything else uses a scoped API key (mcpe_…).

  3. Point your client at the server. The MCP endpoint is a single URL:

    https://mcpemails.com/api/mcp
  4. Your agent works the inbox. It calls tools like inbox_list, email_read (action: "search"), email_compose (action: "send"), and schedule (action: "create"). Each request fetches live from your provider — nothing is mirrored or cached server‑side.

Permissions are scoped per key, so you can hand an agent read:email only, or grant it send and folder management without ever exposing delete.

Quick start (connecting an agent)

Claude Desktop / Cursor (OAuth): add a remote MCP server pointing at https://mcpemails.com/api/mcp and approve the consent screen. Pick the scopes the agent should have.

API key (any MCP client): create a key in the dashboard, choose its scopes and (optionally) restrict it to specific inboxes, then send it as a bearer token:

// Example MCP client config
{
  "mcpServers": {
    "mcpemails": {
      "url": "https://mcpemails.com/api/mcp",
      "headers": { "Authorization": "Bearer mcpe_your_key_here" }
    }
  }
}

The protocol is JSON‑RPC 2.0 over HTTP (MCP 2025-06-18, Streamable transport). Start every session with inbox_list — it returns the inboxes the key can reach, their per‑provider capabilities, and a versioned compatibility profile. The profile marks normalized operations as exact, different, or unavailable, so agents can preserve provider differences rather than silently weakening a request.

Capabilities

  • Live, never stored — email is read straight from your provider on each call; no message bodies are persisted.

  • Multi‑provider — Gmail via OAuth, plus any IMAP/SMTP mailbox (Fastmail, iCloud, Yahoo, Zoho, Yandex, self‑hosted…) via app password.

  • No relay — outbound mail is sent through your provider's SMTP/API, from your real address.

  • Granular scopes — eight permission scopes, grantable independently per API key and per inbox.

  • Batch & search‑and‑act — read, move, delete, or flag up to hundreds of messages in one call, including "search then move/delete" combinators.

  • Drafts & scheduling — compose drafts and queue messages for future send (server‑side dispatch).

  • Provider‑agnostic search — Gmail syntax, IMAP SEARCH, and JMAP are normalized behind one email_read (action: "search") interface.

  • Team‑ready: workspaces, members, roles, SSO, and an audit log on the Team plan.

Tools

11 tools. Most are resource-oriented and take an action argument that selects the specific operation (and, for actions that need different privileges, the required scope):

Tool

Actions

Scope(s)

inbox_list

(single action)

read:email

email_read

list, read, read_batch, search, attachment, extract, original

read:email (search also accepts search:email)

email_organize

move, move_batch, copy, copy_batch, flag, archive, search_and_move

manage:folders (move/copy/search_and_move), send:email (flag/archive)

email_delete

delete, delete_batch, search_and_delete

delete:email

email_compose

send, reply, forward

send:email

folder

list, create, rename, delete

read:email (list), manage:folders (create/rename/delete)

draft

list, create, reply, update, send, delete

manage:drafts (list/create/reply/update/delete), read:email (reply also), send:email (send)

schedule

create, list, cancel

schedule:email

signature

get, set

read:email (get), send:email (set)

automation

create, list, get, update, enable, disable, delete, runs, preview

manage:automations

contact_search

(single action)

manage:contacts

Notes:

  • Tools accept either an explicit inbox_id (UUID) or an inbox email address; single‑inbox keys auto‑resolve the target.

  • Batch actions cap at 50 (email_read's read_batch) to 500 (move/delete/flag) messages per call.

  • For a targeted mutation, first use email_read with action: "search", then pass the returned message_id or message_ids to email_organize or email_delete. Search fields are accepted only by search_and_move and search_and_delete mutation actions.

  • contact_search scans recent mail live — there is no stored address book.

  • email_read's original action returns one complete provider-stored MIME message as a portable .eml file (up to 25 MB). It is read-only and never marks the message as read.

  • draft's send action requires send:email, not manage:drafts — so a key that can only manage drafts can't use them to bypass the send‑mail consent.

  • draft's reply action creates an unsent, provider-native reply in the source conversation. It needs both manage:drafts and read:email, and defaults to replying only to the sender.

  • automation manages unattended scheduled triage rules: a stored search plus one fixed action, evaluated on a cadence with no model in the loop. There is no delete action, a forward always waits for human approval, and draft_reply only ever writes a draft. See docs/automations-trust-boundary.md.

  • tools/list only returns the tools your key (or OAuth token) is actually scoped for.

OAuth scopes

Scope

Grants

read:email

List inboxes & folders; list, read, and search messages

search:email

Narrower alternative that grants only email_read's search action

send:email

Send, reply, forward, flag, archive; also required to send a draft

manage:folders

Create/rename/delete folders; move/copy messages

delete:email

Trash or permanently expunge messages

manage:drafts

Create, edit, and delete drafts (sending one also requires send:email)

manage:contacts

Live contact lookup from recent mail

schedule:email

Queue messages for future delivery

manage:automations

Create and manage unattended scheduled triage rules (no delete action; forwards stay approval-gated)

Supported providers

Provider

Connect via

Read/Search

Send

Folders

Permanent delete

Drafts

Gmail / Google Workspace

OAuth 2.0

Labels

Trash only

Fastmail

App password (IMAP/SMTP)

iCloud, Yahoo, Zoho, Yandex

App password (IMAP/SMTP)

Any IMAP/SMTP mailbox

App password

Outlook / Microsoft 365

OAuth 2.0

🚧 built, gated pending verification

Outlook OAuth is implemented end‑to‑end but currently gated behind Microsoft publisher verification; it is hidden from the connect UI until it ships.

Pricing

The value metric is connected inboxes. Free connects one mailbox, Personal connects up to three, Pro connects every mailbox you own, and Team adds people, roles, and a separate workspace per client. Annual billing saves about 20%.

Free

Personal

Pro

Team

Price

$0

$5/mo · $48/yr ($4/mo)

$15/mo · $144/yr ($12/mo)

$79/mo · $756/yr ($63/mo)

Connected inboxes

1

3

Unlimited

Unlimited

API keys

Unlimited

Unlimited

Unlimited

Unlimited

Members

1 (owner only)

1 (owner only)

1 (owner only)

Unlimited, with roles

Fair‑use rate limit

60 req/min

120 req/min

300 req/min

1,000 req/min

Team roles & workspaces

No

No

No

SSO (SAML/OIDC) + audit log

No

No

No

Support

Community

Email

Email

Priority

Per‑API‑key limits also apply (100 req/min · 1,000/hr · 10,000/day). Rate limits are retryable: they come back as JSON-RPC error -32003 with data.retry_after in seconds.

Every workspace additionally has a fair-use ceiling on billable actions per billing period. It is an abuse guard, not a plan feature: it sits far above any observed real usage, is never shown to customers, and cannot be bought past. Hitting it is not retryable and not a JSON-RPC error: it comes back as a normal tool result with isError: true and a _meta["com.mcpemails/usage_limit"] block, and clears at reset_at.

Internal plan ids predate the names: solo is sold as Pro and pro is sold as Team. The newer personal id is the only one that matches its display name, Personal. Every user who existed before the 2026-08-19 repricing keeps unlimited inboxes for free, permanently. See apps/web/src/lib/stripe/plans.ts.

Architecture

flowchart LR
    Agent["MCP client<br/>(Claude, Cursor, …)"] -->|"JSON-RPC / OAuth or API key"| Web

    subgraph Vercel["Vercel — Next.js 16"]
      Web["/api/mcp route<br/>+ marketing site + dashboard"]
    end

    subgraph Supabase
      Edge["mcp-server<br/>edge function (Deno)"]
      DB[("Postgres<br/>RLS + encrypted creds")]
      Cron["token-refresh<br/>edge functions"]
    end

    Web -->|proxies| Edge
    Edge -->|decrypt creds, fetch live| Providers["Email providers<br/>Gmail API · IMAP/SMTP"]
    Edge --> DB
    Cron --> DB
    Web --> Stripe[("Stripe<br/>billing")]
  • /api/mcp is a thin Next.js route handler that proxies to the Supabase edge function mcp-server — the real MCP implementation, where credentials are decrypted and provider calls are made.

  • The Postgres database stores workspaces, members, inboxes (encrypted tokens/passwords), hashed API keys, OAuth clients, scheduled sends, and an activity log — all guarded by Row‑Level Security.

  • Cron edge functions refresh Gmail/Outlook OAuth tokens before expiry.

Stack: Next.js 16 (App Router) · React 19 · next‑intl 4 · Supabase (Auth, Postgres, Edge Functions) · Stripe · Resend · TypeScript. Email parsing/sanitization via mailparser, jsdom, and isomorphic-dompurify.

Repository layout

.
├── apps/
│   └── web/                     # Next.js 16 app (marketing, dashboard, /api/mcp proxy)
│       ├── app/                 # App Router routes ([locale], dashboard, api, auth)
│       ├── components/          # marketing/ + dashboard/ React components
│       ├── messages/            # next-intl translations (en, nb, es, fr, zh)
│       ├── src/lib/             # stripe/, supabase/, blog/, crypto helpers
│       └── proxy.ts             # middleware: i18n + Supabase session + CDN cache
├── supabase/
│   ├── functions/
│   │   ├── mcp-server/          # the MCP server (tools, auth, scopes)
│   │   ├── gmail-token-refresh/
│   │   └── outlook-token-refresh/
│   └── migrations/              # SQL migrations (schema + RLS)
└── package.json                 # npm workspaces (apps/*)

Local development

Prerequisites: Node.js 20+, npm, and the Supabase CLI (for migrations and edge functions).

# 1. Install (npm workspaces — run from the repo root)
npm install

# 2. Configure environment
cp .env.example apps/web/.env.local
#   then fill in the values (see below) and generate the two secrets:
openssl rand -hex 32   # ENCRYPTION_KEY
openssl rand -hex 32   # CSRF_SECRET

# 3. Run the web app (http://localhost:3000)
npm run dev

# 4. Production build
npm run build

next.config.js validates required env vars at build/start and rejects weak ENCRYPTION_KEY values, so a misconfigured environment fails fast instead of at runtime.

Environment variables

Copy .env.example and fill in real values. Required in every environment:

Variable

Purpose

NEXT_PUBLIC_SUPABASE_URL / NEXT_PUBLIC_SUPABASE_ANON_KEY

Supabase client (public)

SUPABASE_SERVICE_ROLE_KEY

Server‑side admin key (bypasses RLS) — secret

NEXT_PUBLIC_APP_URL

Canonical base URL; drives OAuth redirect URIs

GOOGLE_SITE_VERIFICATION (optional)

Google Search Console HTML-tag verification token; set only in production

ENCRYPTION_KEY

64‑hex AES‑256‑GCM key for credentials at rest — secret

CSRF_SECRET

64‑hex HMAC key for CSRF tokens (distinct from above) — secret

Feature‑dependent:

Variable(s)

Needed for

GMAIL_CLIENT_ID / GMAIL_CLIENT_SECRET

Gmail OAuth (gmail.readonly, gmail.send, gmail.modify)

OUTLOOK_CLIENT_ID / OUTLOOK_CLIENT_SECRET / OUTLOOK_TENANT_ID

Outlook OAuth (Mail.Read, Mail.Send, Mail.ReadWrite, offline_access)

NEXT_PUBLIC_OAUTH_VERIFICATION_PENDING

Shows the unverified‑app warning until Google/Microsoft verification completes

STRIPE_SECRET_KEY / STRIPE_WEBHOOK_SECRET / NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY

Billing

STRIPE_PRICE_PERSONAL_MONTHLY / _YEARLY, STRIPE_PRICE_SOLO_MONTHLY / _YEARLY, STRIPE_PRICE_PRO_MONTHLY / _YEARLY

Plan price IDs (personal = Personal, solo = Pro, pro = Team)

Fastmail and other IMAP providers connect via app password and need no OAuth credentials.

Database & migrations

Schema and Row‑Level Security policies live in supabase/migrations/. Core tables: workspaces, workspace_members, inboxes (encrypted credentials, soft‑deleted), api_keys (hashed, scoped, inbox‑restricted), oauth_clients, scheduled_sends, workspace_invites, and a month‑partitioned activity_log.

# Apply migrations to the linked project
npx supabase db push

# Generate TypeScript types from the live schema
npx supabase gen types typescript --linked > apps/web/src/types/database.ts

The Supabase CLI is the source of truth for DB changes in this project.

Deployment

Web app → Vercel (project mcp-emails-web):

vercel --prod --yes

Security headers and function timeouts are defined in vercel.json. The marketing routes are served with a CDN‑cacheable Cache-Control (set in proxy.ts) so crawlers and repeat visitors hit the edge cache; the dashboard, auth, and API routes stay no-store.

MCP server → Supabase edge function:

npx supabase functions deploy mcp-server --project-ref <your-project-ref> --no-verify-jwt

Self-hosting

Don't want to trust the hosted service with your mail? Run the same MCP server on your own machine. self-host/ ships a containerized stack (Postgres + PostgREST + the Deno server, no Supabase/Stripe/dashboard), so your credentials are encrypted with a key only you hold and decrypted only inside your own container.

cd self-host
make setup      # generate secrets (.env)
make up         # build + start the stack
export IMAP_PASSWORD='your-app-password'
make provision EMAIL=you@example.com IMAP_HOST=imap.fastmail.com SMTP_HOST=smtp.fastmail.com SERVICE=fastmail
make key NAME="my agent"   # mint an mcpe_ key, then point your client at http://localhost:8787

It is IMAP/SMTP-first (Fastmail, iCloud, Yahoo, Zoho, Yandex, generic) via app password; Gmail/Outlook OAuth and the web dashboard remain hosted-only. The container runs supabase/functions/mcp-server/ unmodified; see self-host/README.md for the full guide.

Internationalization

Built with next‑intl (localePrefix: 'as-needed', localeDetection: false for stable canonical URLs). English is served at /; other locales carry a prefix (/nb, /es, /fr, /zh). Translations live under apps/web/messages/.

Supported locales: English, Norwegian Bokmål, Spanish, French, Chinese (Simplified).

Security model

  • Credentials encrypted at rest with AES‑256‑GCM; decrypted only inside the edge function at call time.

  • No message storage — email bodies and attachments are fetched live and never persisted. Attachment text extraction runs transiently in the request and returns no raw attachment bytes.

  • API keys are hashed (only a prefix is stored for display) and scoped per permission and per inbox, with optional expiry.

  • OAuth 2.0 + PKCE for client authorization; Dynamic Client Registration (RFC 7591) for MCP clients.

  • Row‑Level Security isolates every workspace's data at the database layer.

  • Strict CSP, HSTS, X-Frame-Options: DENY, and related headers on every response.

License

MCP Emails is open source under the GNU Affero General Public License v3.0 (AGPL‑3.0). The hosted service at mcpemails.com runs the same server you can self-host, so you can read the code, verify it, and run it yourself. See /security for the trust model.


Send and receive email from any agent. © MCPEmails, AGPL‑3.0.

Available Tools

17 tools
approval_decideReject a pending sendA
Idempotent
Inspect

Reject a send that is waiting for human approval, so it is never delivered. decision accepts only "reject". Approving is deliberately not available over MCP — it requires a signed-in browser session with an owner or admin role, at the review_url of the approval.

ParametersJSON Schema
NameRequiredDescriptionDefault
noteNoOptional reason, stored on the audit record.
decisionYesOnly "reject" is accepted. Approving requires the review page.
approval_idYesThe approval_id returned by a gated send (status: "pending_approval").

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal readOnlyHint=false and idempotentHint=true, so the description's main contribution is explaining the real-world effect: the send 'is never delivered'. It also discloses process constraints — only 'reject' is accepted and approval requires an owner or admin in a browser session. This is meaningful context beyond the structured annotations, though it stops short of stating whether the rejection can be undone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with no filler. The primary action and consequence are front-loaded, and the second sentence covers the critical limitation (no approval via MCP) without digressing into schema details or sibling comparisons. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple mutation with 3 parameters and no output schema, the description is largely sufficient: it clarifies what this tool does, what it cannot do, and how the only decision value behaves. It does not describe the success response or what happens after rejection, but the core decision an agent needs to make — when and how to call it — is fully covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents approval_id, decision, and note. The description adds useful emphasis that decision accepts only 'reject' and explains why approving is not available, but this largely mirrors the schema's own parameter-level description. Thus the description adds only marginal semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reject a send that is waiting for human approval', and adds the key consequence 'so it is never delivered'. It also distinguishes itself from approval actions by declaring that approving is not available over MCP. This makes the tool's unique role unambiguous against siblings like approval_review and approval_schedule.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: use this when a send is pending human approval and needs to be rejected. It also gives a clear when-not: approval is deliberately not offered here and requires a signed-in browser session at the review_url. This routes the agent away from misuse even without naming a sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_reviewReview a pending sendA
Read-onlyIdempotent
Inspect

Fetch the full contents of a send that is waiting for human approval, including its body, so it can be shown in the review card. Read-only. Approving is not possible from here: it requires the signed-in review page linked as review_url.

ParametersJSON Schema
NameRequiredDescriptionDefault
approval_idYesThe approval_id returned by a gated send (status: "pending_approval").

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, and destructiveHint. The description adds useful behavioral context by explicitly stating it is read-only and by explaining that approval is not performed here but requires a separate review page. This goes beyond the annotations and clarifies a key operational boundary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, begins with the primary purpose, and every clause earns its place. It packs the key use case, the read-only nature, and the important limitation about approval without any filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with strong annotations, the description is complete. It tells the agent what will be retrieved (full contents including body), what not to expect (approval capability), and where to direct the user for approval. No output schema is present, but the description sufficiently clarifies the return intent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers the single parameter approval_id at 100%, including its type, format, and source context. The description does not add new parameter semantics beyond what the schema provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Fetch'), a specific resource (a send waiting for human approval), and the purpose (display in the review card). It clearly distinguishes itself from approval_decide by noting that approving is not possible here.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use it: for a send pending approval, to show in the review card. It also gives a clear exclusion: approving is not possible from this tool and requires the signed-in review page linked as review_url. This helps an agent avoid choosing the wrong sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_scheduleSchedule a pending sendA
Idempotent
Inspect

Set the delivery time of a send that is waiting for human approval. Nothing is queued until it is approved; this only decides when an approved message goes out. send_at must be in the future.

ParametersJSON Schema
NameRequiredDescriptionDefault
send_atYesISO 8601 timestamp with timezone, in the future.
approval_idYesThe approval_id returned by a gated send (status: "pending_approval").

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description explains that this action does not queue anything immediately and only determines when an approved message is delivered. It also clarifies the future timestamp requirement. This adds useful behavioral context consistent with the idempotentHint and non-destructive annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight, front-loaded sentences with no filler. The core action, key behavioral caveat, and constraint are all stated efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description covers the essential operational context: it applies to pending approval sends, does not queue until approval, and requires a future send_at. It could mention what happens on repeated calls or error conditions, but the low complexity makes this adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented. The description reiterates the future-time requirement for send_at and references approval_id implicitly through 'waiting for human approval', but adds little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Set') and a precise resource ('delivery time of a send that is waiting for human approval'), and further clarifies that it only schedules an approved message rather than queuing it. This clearly differentiates it from siblings like schedule, approval_decide, and approval_review.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: the tool is for sends waiting for human approval, and it explicitly notes that nothing is queued until approval. It also states the future-time constraint. It does not explicitly name alternative tools or say when not to use it, but the context is sufficient for most agents.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_updateEdit a pending sendA
Idempotent
Inspect

Change the subject or body of a send that is waiting for human approval. The message still has to be approved afterwards, and the reviewer sees the edited version. Subject can only be set on operations that carry one (email_send, schedule_create).

ParametersJSON Schema
NameRequiredDescriptionDefault
subjectNoReplacement subject line.
body_htmlNoReplacement HTML body.
body_textNoReplacement plain-text body.
approval_idYesThe approval_id returned by a gated send (status: "pending_approval").

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover idempotency and lack of destructiveness; the description adds useful behavioral context by noting that the reviewer sees the edited version and that the message still requires approval afterward. This gives an agent a clearer picture of the edit's real-world effect beyond just a generic mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the first names the action, the second explains the post-edit workflow, and the third constrains the subject parameter. The most important information is front-loaded, and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a small update tool, the description plus full schema coverage gives an agent enough to invoke it correctly: what can be changed, the required approval_id, and the continuing approval requirement. A minor gap is that it does not describe the outcome if the approval is no longer pending, but this is not essential for a correct call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all four parameters at 100% coverage, so the baseline applies. The description adds a meaningful nuance beyond the schema by explaining that 'subject' only applies to operations carrying one (email_send, schedule_create), which is directly relevant to when an agent should pass that parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Change') and resource ('a send that is waiting for human approval'), and clearly identifies the editable fields (subject or body). It also clarifies the scope of subject editing by naming which operations carry one, which helps distinguish this from approval_decide and approval_review.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this is for pending sends still awaiting approval, and notes that approval must still happen afterwards, implicitly steering agents away from using this as a final decision tool. It does not explicitly list alternatives or say 'do not use for approved sends,' but the context is strong enough for correct routing among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

automationAutomationsA
Destructive
Inspect

Create and manage unattended scheduled triage rules. A rule is a stored search plus one fixed action, evaluated on a cadence with NO model in the loop: mail is matched, never interpreted. Set action: 'create' (name, filter, rule_action, interval_minutes; the rule is created DISABLED), 'list', 'get' (automation_id), 'update' (automation_id + fields), 'enable'/'disable' (automation_id), 'delete' (automation_id; run history is kept), 'runs' (automation_id, recent run counters), or 'preview' (DRY RUN: reports what a filter matches right now and applies nothing). NOTE the two different keys: action selects the operation on this tool, while rule_action is the action the RULE performs on matching mail. Rule actions are move, label (applied as a Gmail label, an Outlook category or an IMAP keyword), mark_read, forward and draft_reply. DELETING MAIL IS NOT AVAILABLE to an automation. A forward is ALWAYS held for human approval whatever the inbox's approval setting says, and a draft_reply only ever writes a draft. Always 'preview' before you 'enable'. Every action needs manage:automations.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoHuman-readable name for the rule.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoHow many runs to return, newest first.
actionYesOperation to run.
filterNoThe stored search, as the same structured criteria email_search takes: from, to, cc, subject, body, text, unread, has_attachment, flagged, since, before. At least one criterion is required - an empty filter matches the whole mailbox. Provider-native 'raw' queries are NOT accepted here: a rule re-executes unattended for months, and a raw string is a dialect nothing validates.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
rule_actionNoOne tagged action. {type:'move',folder} | {type:'label',label} (applied as a Gmail label, an Outlook category, or an IMAP keyword; on IMAP a label is an atom, so spaces become underscores and ( ) [ ] { } % * " \ are refused) | {type:'mark_read'} | {type:'forward',to:[...],note} | {type:'draft_reply',template}. DELETING MAIL IS NOT AVAILABLE to an automation and is refused. 'forward' is ALWAYS held for human approval regardless of the inbox's approval setting, and 'draft_reply' only ever creates a draft. A draft_reply template substitutes {{sender_name}}, {{sender_email}}, {{subject}} and {{date}} and nothing else; everything else is literal text and message bodies are never interpolated.
automation_idNoThe automation's UUID, as returned by action 'list' or 'create'.
interval_minutesNoMinutes between runs. A fixed ladder, not a free integer: a 1-minute rule hammers a provider into rate limiting.
max_messages_per_runNoPer-run blast radius. Caps how much mail one misconfigured filter can touch before a human sees the run log.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and readOnlyHint=false, so the description carries the burden of elaborating side effects — and it does so thoroughly. It discloses that rules are created DISABLED, delete keeps run history, preview is a DRY RUN, forward is ALWAYS held for approval, draft_reply only writes a draft, and label semantics vary by provider. This goes well beyond the annotation hints and prevents agent surprise.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place. It front-loads the core concept, then systematically covers actions, key naming, rule actions, safety constraints, and permissions. It is longer than average, but the tool's scope — nine operations with nested objects — justifies the length. No filler or tautology.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 10 parameters, nested objects, nine actions, and no output schema, the description is remarkably complete. The schema's conditional blocks handle per-action requirements, while the description supplies all interpretive context: filter criteria reference, raw-query rejection, interval ladder rationale, per-run blast radius, approval behavior, and permission requirements. Nothing an agent needs to invoke this safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning well beyond the schema: it resolves the confusing action vs rule_action naming, explains preview's dry-run semantics, details label application differences (Gmail label, Outlook category, IMAP keyword), and documents draft_reply template substitution limits. The only minor deduction is that parameter semantics could have been even more explicitly mapped to each action.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource combination: 'Create and manage unattended scheduled triage rules.' It immediately clarifies the tool's nature — a stored search plus one fixed action, evaluated on a cadence with no model in the loop. It distinguishes itself from siblings like email_delete and email_compose by enumerating rule actions and explicitly stating deletion is unavailable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit operational guidance: 'Always preview before you enable', notes that every action needs manage:automations, explains the two-key distinction between action and rule_action, and states when the tool is not appropriate (raw queries are rejected, deleting mail is refused). This is strong when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bulk_cancelCancel a previewed bulk operationA
Idempotent
Inspect

Decline a previewed bulk delete or move, so it can never run. Takes only the plan_id. Nothing in the mailbox changes. A preview would also expire on its own after 15 minutes; cancelling records the decision instead of leaving it implicit.

ParametersJSON Schema
NameRequiredDescriptionDefault
plan_idYesThe plan_id returned with a bulk preview.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavior beyond annotations: it states that nothing in the mailbox changes, that previews auto-expire after 15 minutes, and that cancelling records a decision instead of leaving it implicit. These details complement the idempotentHint and destructiveHint annotations and clarify that readOnlyHint=false is consistent with recording a decision.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the core purpose, and every sentence provides value: the consequence of cancellation, the single argument, the lack of side effects, and the expiry/recording nuance. No wasted words or redundant boilerplate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter, full schema coverage, and annotations that cover idempotency and destructiveness, the description fully specifies the scenario, the side-effect behavior, and the operational nuance. An agent has all the information needed to invoke it correctly; no output schema is necessary for such a simple declarative action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for the only parameter, plan_id, with a description ('The plan_id returned with a bulk preview') that is clear and self-sufficient. The description merely reinforces 'Takes only the plan_id,' adding singularity emphasis but no fundamentally new semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Decline'/'cancel') on a specific resource ('a previewed bulk delete or move') and the outcome ('so it can never run'). It distinguishes itself from sibling tools like bulk_execute without naming it, by describing the opposite action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: this is the tool to call after previewing a bulk operation when you want to decline it rather than letting it expire. However, it does not explicitly mention alternatives or when-not-to-use conditions, so the guidance is not as strong as it could be.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bulk_executeRun a previewed bulk operationA
Destructive
Inspect

Run a bulk delete or move that was previewed as a plan. Takes only the plan_id: which messages are affected was decided and frozen when the preview was created, and cannot be changed here. A plan runs at most once and expires 15 minutes after it is created.

ParametersJSON Schema
NameRequiredDescriptionDefault
plan_idYesThe plan_id returned with a bulk preview.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, idempotentHint=false), the description discloses crucial behaviors: the plan executes at most once, expires after 15 minutes, and the affected message set is immutable. This prevents an agent from retrying or modifying after the fact, which is not captured in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences contain only high-value information with no repetition or filler. The core action is front-loaded, and critical constraints follow logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool with annotations covering the safety profile, the description is nearly complete. It might benefit from noting what a successful execution returns, but this is minor given the low complexity and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already documents plan_id with 100% coverage, but the description adds meaningful semantics: it is the only thing accepted, and the messages affected were frozen at preview time. This enriches the parameter beyond a simple schema declaration.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Run') and resource ('bulk delete or move that was previewed as a plan'), clearly differentiating it from bulk_cancel or single-message deletes. The title and first sentence together make the tool's purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly indicates that execution follows a previewed plan and that the plan is frozen, so if an agent needs to change affected messages, this is not the tool. It does not explicitly name bulk_cancel or another alternative, but the constraint context strongly implies when to use it and the one-shot execution rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

draftDraftsA
Destructive
Inspect

Manage unsent drafts in one inbox. On IMAP a draft_id changes on every update, so always use the most recent one. The signature is embedded on create and update (include_signature: false to skip) and 'send' transmits the stored body as-is, so it is never doubled. 'reply' also needs read:email, 'send' needs send:email.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc addresses.
toNoRecipient addresses; a draft may have none.
bccNoBcc addresses.
bodyNoPlain-text draft body.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoDrafts per page.
actionYesOperation to run. list = saved drafts; create = a new draft, subject and body required; reply = an unsent reply to message_id, kept in its thread; update = overwrite draft_id with the fields you pass; send = send draft_id and remove it from Drafts; delete = discard draft_id without sending.
subjectNoDraft subject line.
draft_idNoDraft id from the most recent draft call. On IMAP it changes after every update, so a stale one fails.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
html_bodyNoOptional HTML draft body.
reply_allNoAddress the reply to the original To and Cc too.
message_idNoMessage id to reply to.
idempotency_keyNoOpaque key for one operation, outbound or mailbox mutation. Reuse it only when retrying the identical request within 24 hours: the retry is collapsed, not repeated, which matters most for copy. Reuse with different arguments is rejected; omit it for normal behaviour.
include_signatureNoAppend the inbox's configured signature. Set false for a terse reply or your own sign-off.

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only indicate readOnly=false and destructiveHint=true, so the description carries real weight here. It adds non-obvious behavioral detail: IMAP draft_ids change on every update, signatures are embedded at create/update time, send transmits the stored body as-is to avoid double signatures, and reply/send require specific scopes. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, front-loaded with the core purpose, followed by the most important operational caveats. Every sentence adds distinct information with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 15 parameters and 6 actions, the schema carries most structural detail and the description supplies the missing operational context: draft_id freshness, signature behavior, and permission requirements. It is not a 5 because it does not enumerate the possible actions or mention return-value expectations, though the lack of an output schema lowers that burden.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value beyond the schema by clarifying that include_signature is embedding on create/update and that send uses the stored body verbatim, which prevents a common double-signature mistake. It does not need to repeat every parameter because the schema already documents them thoroughly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states that the tool manages unsent drafts and the action enum spells out six concrete operations (list, create, reply, update, send, delete), so an agent can identify its purpose. It stops short of 5 because 'Manage' is a generic verb and no explicit contrast with sibling tools such as email_compose is provided.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The resource 'unsent drafts' implies the main use case, and the schema action descriptions give within-tool guidance for choosing list versus create versus reply, etc. However, the description never names alternative sibling tools or states when not to use this tool, so the guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

email_composeCompose EmailAInspect

Send new mail, reply, or forward from one inbox. The inbox's signature is appended automatically, above the quoted text on replies and forwards; pass include_signature: false to suppress it.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc addresses.
toNoRecipient addresses.
bccNoBcc addresses; not visible to the other recipients.
bodyNoPlain-text body. Sent as multipart/alternative when html_body is given too.
fromNoGmail Send As address. Must be a verified identity from inbox_list; anything else is rejected.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
actionYesOperation to run. send = new message from to/subject/body, optionally cc/bcc/html_body/attachments; reply = answer a message_id, optionally reply_all; forward = pass a message_id on to new recipients.
subjectNoSubject line, sent as-is with no prefix added.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
reply_toNoReply-To address, so replies go here instead of to the sender.
html_bodyNoHTML body. Not sanitized before sending, so it is on you to keep it safe and well-formed.
reply_allNoReply to the original To and Cc as well as the sender. Still capped at 50 recipients.
message_idNoMessage id being replied to; threading headers derive from it.
attachmentsNoFile attachments, 10 MB total.
idempotency_keyNoOpaque key for one operation, outbound or mailbox mutation. Reuse it only when retrying the identical request within 24 hours: the retry is collapsed, not repeated, which matters most for copy. Reuse with different arguments is rejected; omit it for normal behaviour.
include_signatureNoAppend the inbox's configured signature. Set false for a terse reply or your own sign-off.
include_attachmentsNoRe-attach the original's attachments. Anything past the 10 MB budget is dropped silently.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already convey this is a mutating, non-idempotent operation. The description adds a meaningful behavioral detail beyond the schema: the inbox signature is appended automatically, and it is placed above quoted text on replies and forwards. This helps the agent predict side effects and know when to set include_signature to false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact, front-loaded sentences with no filler. The first sentence states the core operations; the second provides the one behavioral caveat an agent most needs before composing replies or forwards.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 17 parameters and conditional schemas, the description gives the essential high-level shape while the input schema covers details like inbox selection, attachments, idempotency, and recipient limits. The only notable omission is any mention of return values, but no output schema is provided and the tool's success/failure behavior is largely inferable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 17 parameters thoroughly. The description adds only a small nuance about signature placement relative to quoted text; it does not substantially enrich parameter understanding beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names specific actions ('Send new mail, reply, or forward') and a clear resource ('from one inbox'). These verbs distinguish it sharply from sibling tools like email_read, email_delete, and email_organize, so an agent can select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly establishes the use case: any time the user needs to send, reply to, or forward email. It does not list alternatives or explicitly say when not to use this tool, but the context is unambiguous enough and clearly separated from the sibling read/delete/organize operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

email_deleteDelete EmailA
Destructive
Inspect

Delete messages in one inbox. Flagged DESTRUCTIVE so your MCP client can ask for confirmation first. Deleted mail goes to Trash and stays recoverable unless you pass permanent: true, which is irreversible. Needs the delete:email scope.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc recipient to match: address, name, or fragment.
toNoTo recipient to match: address, name, or fragment.
bodyNoText to find in the body. On Gmail this matches the whole message.
fromNoSender to match: address, name, or fragment.
textNoText to match anywhere, headers included.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoCap on messages deleted. Default 500.
queryNoProvider-native raw query (escape hatch); prefer the structured fields. Ignored on Fastmail.
sinceNoReceived on or after this date or datetime (no timezone = UTC).
actionYesOperation to run. delete = one message_id; delete_batch = up to 500 message_ids; search_and_delete = every message matching a search.
beforeNoReceived strictly before this date or datetime (no timezone = UTC).
unreadNotrue = unread only; false = read only; omit for both.
flaggedNotrue = only flagged/starred messages. Ignored on Outlook.
subjectNoText to match in the subject; phrases match as-is.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
permanentNoHard-delete, bypassing Trash. Default false, which trashes it.
message_idNoProvider-native message id from a list or search.
message_idsNoProvider-native message ids to delete.
has_attachmentNotrue = only messages with an attachment. Ignored on generic IMAP.
idempotency_keyNoOpaque key for one operation, outbound or mailbox mutation. Reuse it only when retrying the identical request within 24 hours: the retry is collapsed, not repeated, which matters most for copy. Reuse with different arguments is rejected; omit it for normal behaviour.
include_foldersNoFolder names to search.

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses that mail goes to Trash and is recoverable unless permanent:true is passed, introduces the irreversible case, and calls out that the MCP client should ask for confirmation. It adds meaningful behavioral context beyond the annotations and does not contradict them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences: the first front-loads the action and scope, the second addresses safety/confirmation, and the third covers recovery, irreversibility, and auth. Every sentence earns its place with zero fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a complex 21-parameter conditional schema with three action modes, the description does not mention delete, delete_batch, or search_and_delete, nor the filter-based search behavior. The schema compensates heavily, but the description alone would be incomplete for an agent deciding how to invoke this destructive multi-mode tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with rich descriptions on every parameter, including action modes, filters, and permanent. The description itself adds no parameter-level meaning beyond highlighting permanent:true, which the schema already documents. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Delete messages in one inbox.' It is unambiguous about the core purpose. However, it does not explicitly differentiate from siblings like email_organize or bulk_cancel, leaving the agent to rely on the name for disambiguation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for deleting messages and notes the required delete:email scope, but gives no explicit when-to-use guidance, exclusions, or alternatives among sibling tools. It also does not explain when to choose delete vs delete_batch vs search_and_delete—that is left to the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

email_organizeOrganize EmailA
Destructive
Inspect

Move, copy, flag or archive messages in one inbox. Get message ids from email_read first. On Gmail a move adds the destination label and removes INBOX, leaving other labels in place. Needs manage:folders; deleting is the separate email_delete tool.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc recipient to match: address, name, or fragment.
toNoTo recipient to match: address, name, or fragment.
bodyNoText to find in the body. On Gmail this matches the whole message.
fromNoSender to match: address, name, or fragment.
textNoText to match anywhere, headers included.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoCap on messages moved. Default 500.
queryNoProvider-native raw query (escape hatch); prefer the structured fields. Ignored on Fastmail.
sinceNoReceived on or after this date or datetime (no timezone = UTC).
actionYesOperation to run. move = one message_id to destination_folder_id; move_batch = the same for up to 500 message_ids; copy = duplicate into destination_folder_id, original stays, IMAP/Outlook/Fastmail only (never Gmail); copy_batch = the same for up to 500 message_ids; flag = set read/unread/flagged on message_ids via flag_action; archive = move one message_id out of the Inbox; search_and_move = move everything matching a search, the only action the search filters apply to.
beforeNoReceived strictly before this date or datetime (no timezone = UTC).
unreadNotrue = unread only; false = read only; omit for both.
flaggedNotrue = only flagged/starred messages. Ignored on Outlook.
subjectNoText to match in the subject; phrases match as-is.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
message_idNoProvider-native message id from a list or search.
flag_actionNoState to apply to every listed message; flag/unflag add or remove the star.
message_idsNoProvider-native message ids to move.
has_attachmentNotrue = only messages with an attachment. Ignored on generic IMAP.
idempotency_keyNoOpaque key for one operation, outbound or mailbox mutation. Reuse it only when retrying the identical request within 24 hours: the retry is collapsed, not repeated, which matters most for copy. Reuse with different arguments is rejected; omit it for normal behaviour.
include_foldersNoFolder names to search. IMAP covers INBOX only when omitted.
destination_folder_idNoTarget folder: an alias (inbox, sent, drafts, trash, archive, spam), a folder name, or a folder id. Names and aliases resolve for you.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as mutating, and the description adds useful behavioral context: Gmail's move label semantics, the permission prerequisite, and the one-inbox scope. This is real operational detail beyond what the annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences cover scope, workflow prerequisite, provider behavior, permission, and sibling routing. There is no filler, repetition, or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with seven action variants and no output schema, the description provides the essential invocation context: where ids come from, what permission is needed, how Gmail behaves, and the deletion boundary. The schema handles per-action parameter constraints, so the description is appropriately balanced.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description does not need to document the 22 parameters. The prose reinforces the message-id workflow but does not add parameter-level meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb+resource pairing: 'Move, copy, flag or archive messages in one inbox.' It also distinguishes the tool from email_delete by explicitly stating that deleting is a separate tool, so the agent can identify the tool's scope without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete workflow guidance: retrieve message ids from email_read first, requires manage:folders permission, and explicitly routes deletion to email_delete. It does not spell out when the search-based action should be used instead of the id-based actions, but the schema's action parameter fills that gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

email_readRead EmailA
Read-onlyIdempotent
Inspect

Read, list and search email in one inbox. list and search return a single page: when the response says has_more, call again with the returned next_offset and otherwise identical arguments. Only has_more: false means you have seen everything. Long bodies are windowed the same way: body_truncated means read again with body_next_offset as body_offset.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc recipient to match: address, name, or fragment.
toNoTo recipient to match: address, name, or fragment.
bodyNoText to find in the body. On Gmail this matches the whole message.
fromNoSender to match: address, name, or fragment.
textNoText to match anywhere, headers included.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoMessage summaries per page. Prefer paginating over a large limit.
queryNoProvider-native raw query (escape hatch); prefer the structured fields. Ignored on Fastmail.
sinceNoReceived on or after this date or datetime (no timezone = UTC).
actionYesOperation to run. list = recent messages, optionally by folder or unread; read = full content of one message_id; read_batch = up to 50 message_ids, bodies windowed tighter than read; search = structured filters (from/to/subject/body/since/before/unread/has_attachment/flagged); attachment = download one attachment by attachment_index or filename, base64; extract = readable text from one attachment, without its bytes; original = the whole stored message as an .eml resource.
beforeNoReceived strictly before this date or datetime (no timezone = UTC).
folderNoFolder to list, case-sensitive: 'INBOX', 'SENT', 'DRAFTS', 'TRASH', or provider-specific such as '[Gmail]/Spam'.INBOX
offsetNoZero-based page offset. Pass the previous response's next_offset exactly; a short page is not proof of the end. Newest first.
unreadNotrue = unread only; false = read only; omit for both.
flaggedNotrue = only flagged/starred messages. Ignored on Outlook.
subjectNoText to match in the subject; phrases match as-is.
filenameNoExact attachment filename, case-insensitive. Ignored when `attachment_index` is given.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
message_idNoProvider-native message id, from a previous list or search.
body_offsetNoStart of the plain-text window. Pass back body_next_offset to continue a truncated body.
message_idsNoMessage ids to read. Duplicates are removed, first occurrence kept.
unread_onlyNoReturn only unread messages.
include_htmlNoAlso return the sanitized HTML body. Worth it only when you need the formatting or structure.
mark_as_readNoMark the message read at the provider after fetching it.
body_max_charsNoBody chars per message. Default 8000 here, 2000 on read_batch. 0 returns headers only.
has_attachmentNotrue = only messages with an attachment. Ignored on generic IMAP.
include_foldersNoFolders to search. IMAP covers INBOX only unless you name archive or sent folders; Gmail always searches everything.
attachment_indexNo0-based position in the `attachments` list from action: read. Wins over `filename`.
body_html_offsetNoThe same for body_html: pass back body_html_next_offset.
include_attachmentsNoInline attachment bytes as base64, sharing one 10 MB budget. Files over 2 MB are NOT inlined; they return metadata with a `note`. Metadata (filename, mime_type, size_bytes, attachment_index) always comes back anyway, so prefer false, then fetch the one file you need with action: attachment by its attachment_index (up to 25 MB).

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds genuinely non-obvious behavior beyond that: single-page returns with has_more/next_offet continuation ('Only has_more: false means you have seen everything') and windowed bodies via body_truncated/body_next_offet. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences with zero filler. The purpose is front-loaded in sentence one, and each of the two protocol traps (page continuation, body windowing) gets one dense sentence that earns its place. Nothing is redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 30-parameter, 7-action tool with no output schema, the description captures the trickiest protocol contract — pagination and body windowing — that an agent would most likely get wrong. Operational details like per-action semantics, the 10 MB attachment budget, inbox disambiguation, and provider quirks are carried by the thoroughly described schema, so the division of labour is reasonable. Return shapes aren't covered, but the absent output schema makes that a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the parameter docs already explain the continuation semantics (offset: 'Pass the previous response's next_offset exactly'; body_offset: 'Pass back body_next_offset to continue a truncated body'). The description reinforces this at the protocol level but adds little the schema didn't already say, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific scope: 'Read, list and search email in one inbox.' The verbs (read, list, search) name the concrete operations and the resource is unambiguous. It doesn't explicitly differentiate from siblings like inbox_list or email_organize, but the operation set is precise enough that an agent can tell what this tool does at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit when-to-use-vs-alternatives guidance for sibling tools. It does teach the pagination loop within the tool, and the schema's `action` parameter description routes the agent to the right action (list/read/read_batch/search/attachment/extract/original) with per-action semantics. This is implied rather than explicit guidance, so a 3 fits.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

folderFolders & LabelsA
Destructive
Inspect

Manage mailbox folders, which are labels on Gmail: the arguments say 'folder' for cross-provider compatibility, but Gmail returns and manages labels (type: 'label'). 'list' needs read:email, the rest manage:folders.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoName of the new folder or label.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
actionYesOperation to run. list = every folder with its id and message counts; create = a folder called `name`; rename = folder_id to new_name; delete = folder_id, irreversibly.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
new_nameNoNew display name.
folder_idNoFolder id from action: list. On IMAP this is the mailbox name (e.g. 'INBOX/Work'), on Gmail the label id.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Given the annotations already mark it non-read-only and destructive, the description adds useful behavioral context: Gmail labels are returned/managed instead of folders, and action-specific permission scopes are disclosed. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the main purpose and then adds two high-value clarifications (Gmail label equivalence and permission split). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus a rich schema covers the tool's four actions, required parameters, provider-specific behavior, and permissions. It omits any mention of alternatives, but that gap is captured under usage_guidelines; overall context is sufficient for a competent agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains each parameter, including the Gmil vs IMAP interpretation of folder_id. The tool description adds only the cross-provider framing, which helps conceptual understanding but does not significantly extend the schema's param-level documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a clear verb-resource pair: 'Manage mailbox folders', and adds the critical nuance that on Gmil these are labels. It does not explicitly differentiate itself from siblings like email_organize, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than explicitly scoped: an agent can infer to use this tool when managing folders/labels. It provides permission guidance ('list needs read:email, the rest manage:folders') but does not name alternatives or state when NOT to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inbox_listList InboxesA
Read-onlyIdempotent
Inspect

List every inbox (mailbox or account) this API key may use. Call it FIRST for the inbox_id the other tools take. Each entry carries the UUID, email address, display name, provider, optional service brand (icloud/yahoo/zoho/yandex/generic) and a capabilities object.

ParametersJSON Schema
NameRequiredDescriptionDefault
providerNoReturn only inboxes served by this provider. Omit for all of them.
include_capabilitiesNoInclude each inbox's capabilities object. Set false for a compact list of inbox_id, email address, display name, provider and brand.

Output Schema

ParametersJSON Schema
NameRequiredDescription
inboxesYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds valuable context by clarifying that results are scoped to the API key and that each entry includes UUID, email, display name, provider, optional brand, and capabilities—information that helps an agent select the correct inbox_id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The purpose is front-loaded, the critical 'call it FIRST' instruction is prominent, and the output payload is summarized efficiently without reproducing the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a simple read-only list tool with an output schema. It explains the tool's purpose, when to use it, what the response contains, and how the response relates to other tools. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents provider and include_capabilities well. The description does not add new param-level meaning beyond mentioning the capabilities object in the response, but it does not need to because the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List every inbox (mailbox or account) this API key may use.' It clearly distinguishes the tool's role from siblings by positioning it as the entry point that supplies the inbox_id for other tools. Each output field is listed, so an agent knows exactly what to expect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to 'Call it FIRST for the inbox_id the other tools take,' giving clear contextual guidance on when this tool should be used. It does not discuss when not to use it or name alternatives, but no sibling serves the same discovery/list role, so this level of guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scheduleScheduled SendAInspect

Queue mail for later delivery, and manage what is queued.

ParametersJSON Schema
NameRequiredDescriptionDefault
ccNoCc addresses.
idNoScheduled send UUID from a create or list call. Alias: scheduled_send_id.
toNoRecipient addresses.
bccNoBcc addresses.
bodyNoPlain-text body. Sent as multipart/alternative when html_body is given too.
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
limitNoResults per page.
actionYesOperation to run. create = queue to, subject and body for send_at; list = pending scheduled sends; cancel = a pending send by `id`, alias `scheduled_send_id`.
send_atNoSend time, in the future and carrying a timezone (e.g. '2026-06-01T09:00:00+02:00'). The dispatcher runs every minute, so delivery can be up to 60s late.
subjectNoSubject line.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
reply_toNoReply-To address.
html_bodyNoOptional HTML body.
attachmentsNoFile attachments, 10 MB total.
idempotency_keyNoOpaque key for one operation, outbound or mailbox mutation. Reuse it only when retrying the identical request within 24 hours: the retry is collapsed, not repeated, which matters most for copy. Reuse with different arguments is rejected; omit it for normal behaviour.
scheduled_send_idNoAlias of `id`; pass either one.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that this is a non-read-only, non-idempotent operation, and the description adds the scheduling-delivery context. It does not describe side effects like cancellation removing a queued item, delivery timing tolerance, or idempotency nuances, though some of these are captured in the input schema's parameter descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. It clearly states the core behavior first and uses a short second clause to cover management actions. It is appropriately concise, though 'manage' is a somewhat broad term that could be more specific.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema that fully documents the create/list/cancel actions and their parameters, the high-level description is sufficient for an agent to orient itself. The description does not mention return values, but no output schema exists and the action descriptions in the schema already indicate what list returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all 16 parameters and the action enum. The tool description itself adds no parameter-level meaning, but it is not required to compensate because the schema is fully explicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses an active verb and a clear resource: 'Queue mail for later delivery, and manage what is queued.' This makes the tool's main purpose understandable and distinct from immediate send tools, though it does not explicitly name sibling tools or explain how it differs from email_compose or draft.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for later delivery' implies when the tool should be used, and 'manage what is queued' covers listing and canceling scheduled sends. However, there is no explicit guidance about when not to use it, no mention of alternatives like email_compose for immediate sending, and no stated prerequisites for scheduling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

signatureSignatureA
Idempotent
Inspect

Read or set an inbox's signature, which the server appends on send/reply/forward/draft/scheduled mail. Setting one marks the source 'manual', which overrides Gmail auto-import. 'get' needs read:email, 'set' needs send:email.

ParametersJSON Schema
NameRequiredDescriptionDefault
inboxNoInbox email address; an alternative to inbox_id, which wins when both are given.
actionYesOperation to run. get = current signature_html and text, enabled flag, reply_mode and source; set = write signature_text and/or signature_html.
inbox_idNoInbox UUID. Optional when the key has exactly one inbox. Otherwise pass this or `inbox`; omit both and the error lists every inbox_id.
signature_htmlNoHTML signature. Omit to keep, empty string to clear. Derived from the text version when only that is given.
signature_textNoPlain-text signature. Omit to keep, empty string to clear.
signature_enabledNoWhether the signature is appended at all. Defaults to true.
signature_reply_modeNoSignature on replies and forwards; 'first_only' is the default.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal non-read-only, idempotent, and non-destructive traits. The description adds non-obvious behavioral details: the signature is appended on send/reply/forward/draft/scheduled mail, and setting it overrides Gmail auto-import by marking the source 'manual'. These are useful disclosures beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with no filler. It front-loads the core operation, then adds only high-value behavioral and permission context, earning each sentence's place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers authentication needs, side effects, and the server's signature behavior, while the detailed input schema covers parameter semantics, conditional constraints, and defaults. No output schema exists, but the 'action' parameter already documents what 'get' returns, so the definition is sufficiently complete for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter already has a meaningful description including enum values, defaults, and conditional constraints. The tool description does not need to add per-parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Read or set an inbox's signature', and adds clarifying behavioral context about server-side appending. This distinguishes it from sibling tools like email_read, email_compose, or draft, none of which manage signatures.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operation-specific context: 'get' needs read:email, 'set' needs send:email, and setting marks the source as 'manual', overriding Gmail auto-import. It doesn't explicitly name alternative tools, but no sibling appears to overlap with signature management, so the guidance is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 17 tool updatesv1.0.4
    • First observedapproval_decide
    • First observedapproval_review
    • First observedapproval_schedule
    • First observedapproval_update
    • First observedautomation
    • First observedbulk_cancel
    • First observedbulk_execute
    • First observedcontact_search
    • First observeddraft
    • First observedemail_compose
    • First observedemail_delete
    • First observedemail_organize
    • First observedemail_read
    • First observedfolder
    • First observedinbox_list
    • First observedschedule
    • First observedsignature

TDQS

A3.7/5.0
Disambiguation4/5

Most tools target clearly distinct resources or actions: email_read, email_compose, email_delete, and email_organize cover separate core operations, while approval_* and bulk_* are contextually separate. Some minor ambiguity exists between draft and email_compose (both can create/send composed content) and between schedule and approval_schedule, but descriptions generally resolve the boundaries.

Naming Consistency3/5

Naming mixes several conventions: email_* action verbs, approval_* verbs, bulk_* verbs, noun-style resource tools (folder, draft, schedule, signature, automation), and noun_verb tools (inbox_list, contact_search). Each group is internally consistent, but the set as a whole lacks a single predictable pattern.

Tool Count3/5

At 17 tools, the surface is on the heavier side of the typical range. Each tool covers a real capability, but several resource-style tools bundle many sub-operations (folder, draft, automation), which could be consolidated or more evenly split.

Completeness3/5

Core email operations, drafts, scheduling, signatures, approvals, automations, and contacts are broadly covered. However, bulk_execute and bulk_cancel reference a 'previewed plan' but no visible tool creates such a plan, leaving an obvious dead-end in the bulk workflow. Other minor gaps like no explicit read/unread toggle may also require workarounds.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Give Claude (or any MCP client) a real email inbox and SMS. Your AI agent can read and send email, manage inboxes, track delivery, and handle SMS.
    27
    1
    Apache 2.0
  • A
    license
    A
    quality
    D
    maintenance
    Provider-agnostic email MCP server that connects any IMAP mailbox to AI assistants, enabling email management through natural language.
    8
    AGPL 3.0
  • A
    license
    A
    quality
    A
    maintenance
    Connect all your email accounts to your AI agent — not just one. AnyMail MCP is a local MCP server that gives an agent full read/send/organize/delete access across multiple Gmail accounts at once, over IMAP/SMTP.
    26
    34
    2
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Albretsen/MCPEmails'

If you have feedback or need assistance with the MCP directory API, please join our Discord server