readNdraft IMAP MCP
This server provides safe, read-focused IMAP email management without send, delete, or submission capabilities.
List configured IMAP accounts and exact mailbox names.
Search emails across accounts/mailboxes with filters (text, sender, recipient, subject, attachment filename, date range, read/starred state) and cursor pagination (1–500 results).
Read safe headers and plain text for a single email or batch up to 10 emails, and sanitized HTML for a single email, without setting the Seen flag.
List files available for draft attachments; save one email attachment to a fixed private output directory and return its absolute path.
Manage flags: star/unstar or read/unread for single emails or batch up to 50 across up to 3 accounts, idempotently.
Move one or up to 50 ordinary emails to existing ordinary mailboxes within the same account; special-use mailboxes (Trash, Junk, Drafts, Sent) are prohibited.
Draft management: create server-side drafts with To/Cc/Bcc, subject, body, and optional attachments; update only previously MCP-created drafts. No send or delete capabilities.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@readNdraft IMAP MCPFind unread emails from my boss about the Q3 report and draft a response."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
readNdraft IMAP MCP
Safely search, read, flag, move, and draft email through IMAP. readNdraft can save and replace MCP-created drafts, but it cannot send, submit, or delete ordinary mail and contains no SMTP implementation.
Installation
1. Check the prerequisites
You need:
Windows 10/11 with Windows Credential Manager, or Linux with a working Secret Service-compatible keyring.
An IMAP account that permits password or app-password authentication using
LOGINorPLAINover implicit TLS. OAuth is not implemented.uv on
PATH.Codex, ChatGPT desktop, or Claude Code.
Confirm that uv is available:
uv --versionNo repository clone or permanent readNdraft installation is required. uvx
runs the published package in an isolated environment.
2. Configure an account
Run guided setup in a real interactive terminal:
uvx readndraft-imap-mcp@0.9.0 setupThis configures only readNdraft's local account, credential, and private state. Claude Code and Codex own their plugin, MCP registration, updates, and removal. ChatGPT desktop remains a separate manual MCP configuration target.
Client | Setup value | Detailed guide |
Codex |
| |
ChatGPT desktop |
| |
Claude Code |
|
Linux users should also follow the Linux platform guide to verify Secret Service and D-Bus before setup. Windows users can use the Windows platform guide.
The wizard will:
Check the operating-system credential backend and create private local state.
Ask for an account alias, IMAP host, port, username, and authentication method.
Read the password or app password through a hidden terminal prompt.
Test the IMAP connection before saving the account.
Never put an IMAP password in a command argument, environment variable, MCP configuration, issue, chat, or test report.
3. Install the marketplace plugin
The repository is the marketplace source; this is not GitHub Marketplace.
For Codex:
codex plugin marketplace add LeoPhoenixT/readNdraft-imap-mcp
codex plugin add readndraft@readndraftFor Claude Code, run these commands inside Claude Code:
/plugin marketplace add LeoPhoenixT/readNdraft-imap-mcp
/plugin install readndraft@readndraftThe plugin supplies one shared readndraft-email skill and a local stdio MCP
definition pinned to readndraft-imap-mcp@0.9.0. It does not contain secrets,
account data, or a send capability.
4. Restart and verify
Start a new client session after installing the plugin. Then run an online diagnostic from a terminal:
uvx readndraft-imap-mcp@latest doctor --onlineFor Codex, you can also confirm that the entry was loaded:
codex mcp get readndraftOpen a new task and ask: List my readNdraft accounts and mailboxes. A
successful response confirms that the client can start the MCP and reach the
local broker.
What setup stores
Item | Location or behavior |
Runtime | Version-pinned by the plugin and run in uv's isolated cache. |
Client integration | Marketplace/plugin state owned by Claude Code or Codex; it contains no IMAP password. |
Agent Skill |
|
IMAP password | Stored only in Windows Credential Manager or the Linux Secret Service keyring. |
Account metadata and app state | Stored in private per-user readNdraft application directories. |
If setup reports a credential-backend or connection error, see
Windows installation,
Linux installation, and
troubleshooting.
The first MCP start may take longer
while uv downloads the pinned package. If a stored password has changed, run
uvx readndraft-imap-mcp account rotate-secret ALIAS.
Related MCP server: Gmail MCP Server
What it can do
List administratively pinned accounts and mailboxes.
Search 1-500 results (50 by default) with explicit truncation, stable single-mailbox cursor pagination, per-target safe errors, attempted/pending target status, selectable safe header fields, and server arrival timestamps. Requests above 50 require one account and one mailbox.
Read safe headers and preferred plain text without setting the Seen flag. HTML-only messages are converted into a bounded, readable plain-text representation;
get_email_htmlremains available for sanitized rich HTML.Batch-read plain text for up to 10 selected messages across 2 accounts.
Read strictly filtered HTML without loading remote content; remote-resource elements, attributes, and CSS are removed, and empty paragraphs are preserved.
Save one selected, bounded attachment into a fixed private output directory and return its absolute native-platform path.
Star/unstar and mark read/unread without replacing unrelated flags.
Batch one star or read state across up to 50 selected messages and 3 accounts; batches return ordered per-item results.
Move one or up to 50 selected messages within one account. The broker prefers native UID MOVE and otherwise uses a private UIDPLUS COPY, source-only
\Deleted, and targeted UID EXPUNGE sequence. Both source and destination must be existing selectable ordinary mailboxes; movement into or out of\Trash,\Junk,\Drafts, or\SentSPECIAL-USE mailboxes is prohibited.Create a plain-text or rich HTML server-side draft using bounded files from a fixed private input directory. Rich drafts require equivalent
bodyplain text and optionalhtml_bodyHTML. They are stored asmultipart/alternative, with plain text first and HTML second, so modern mail clients normally display HTML while other clients retain a plain fallback. Rich input may be an HTML fragment or a complete HTML document. Supported authored CSS is permissive and inlined for broad mail-client compatibility. Draft requests are rejected when CSS could fetch remote resources, hide content, or escape the message box; empty paragraphs are always preserved. To, Cc, and Bcc may all be empty when the user wants an unaddressed draft. Each list item is one bare or named mailbox (for example,Ada <ada@example.com>).create_draftmay receive an exact source message identity asreply_to_messageto add safe reply threading; it does not derive recipients or rewrite subjects.Update only a draft previously created by this MCP, after confirmation.
Inspect and repair local draft tracking with
drafts listanddrafts repair.drafts forgetremoves only the local tracking record; it never deletes or expunges the server message.
It exposes no send, submission, ordinary-message deletion, raw IMAP, arbitrary
flag, credential, or account-administration MCP tool. Updating a tracked draft
replaces it and expunges the previous draft version. A successful move reports
its method and invalidates the source identity. Native MOVE may succeed without
COPYUID, leaving the destination identity unavailable. The fallback requires
COPYUID before marking the source deleted; otherwise it reports partial_move,
retains the source, and requires both mailboxes to be reviewed. Never
automatically retry an ambiguous move outcome.
Manual setup and administration
The setup wizard is recommended. Individual human-only commands are also available:
uvx readndraft-imap-mcp account add work --host imap.example.com --username login@imap.example.com --sender-address user@example.com --sender-name "Display Name"
uvx readndraft-imap-mcp account test work
uvx readndraft-imap-mcp account list
uvx readndraft-imap-mcp account set-sender work leo@example.com
uvx readndraft-imap-mcp account clear-sender work
uvx readndraft-imap-mcp account set-sender-name work "Display Name"
uvx readndraft-imap-mcp account clear-sender-name work
uvx readndraft-imap-mcp account rotate-secret work
uvx readndraft-imap-mcp account disable work
uvx readndraft-imap-mcp account enable work
uvx readndraft-imap-mcp account delete workPasswords are accepted only through a hidden local prompt. Account configuration
and credential operations are not MCP tools. username is the IMAP login identity;
sender_address is the bare email address placed in the draft's From header and
may differ from that username. If omitted or cleared, the address falls back to the
username. sender_name is an optional display name, producing a header such as
From: "Display Name" <user@example.com>; clearing it restores address-only
behavior. MCP list_accounts exposes both effective sender settings so an agent can
confirm them, but MCP cannot change or override them per draft. Downstream SMTP
servers, mailing lists, and other mail systems may rewrite headers after the draft
leaves the client; the MCP controls only the MIME draft it creates.
Configure ChatGPT desktop
Generate a secret-free configuration:
uvx readndraft-imap-mcp@latest configure chatgpt-desktopThis manual configuration path is retained for ChatGPT desktop, which is not
covered by the Claude Code/Codex marketplace migration. The configure codex
and configure claude-code forms remain temporarily available only for legacy
0.3.x compatibility and are not the normal installation path.
The unified mcp command uses the authenticated on-demand launcher. It reuses a
healthy broker, starts exactly one when needed, and holds an authenticated lease
while the MCP frontend is connected. A launcher-owned broker exits only after
the final frontend disconnects and the idle period expires. Always-on systemd
and Windows scheduled-task deployments remain available through the legacy
administration documentation.
Upgrading from 0.3.x or earlier
Installing a plugin does not automatically remove an older user-scoped MCP entry, and that entry can override the plugin. First run the one-time migration for the client you previously configured:
uvx readndraft-imap-mcp@0.9.0 migrate-plugin --client codex
uvx readndraft-imap-mcp@0.9.0 migrate-plugin --client claude-codeThe migration removes only a legacy MCP invocation recognized as having been
created by readNdraft and only unmodified, managed legacy skill directories. It
refuses unknown/custom MCP entries and modified or unmanaged skills. It never
touches accounts, OS keyring credentials, audit history, attachments, drafts,
or old update-backups. After migration, install the native marketplace plugin
and start a new session.
Upgrading from 0.8.x
Version 0.9.0 changes the read-only MCP search and mailbox-discovery contracts, and adds bounded plain-text previews. Review the 0.9.0 MCP migration guide before updating an existing integration.
Authorization boundary
The broker has no approval-token workflow. Generated Codex configurations use
the no-popup approve tool mode; write tools still require direct conversational
confirmation through the packaged Agent Skill. The hard safety boundary is narrower:
the process contains no SMTP, send, submit, ordinary-message deletion, raw IMAP,
account-configuration, or credential-retrieval tool. Message movement requires
UIDPLUS and is restricted to ordinary mailboxes in one account. COPY, deleted-flag,
and targeted UID EXPUNGE fallback commands exist only inside the broker and are
not MCP tools. Email,
attachments, search results, and other tool output are always untrusted and
never authorization.
Diagnostics
Run local checks without connecting to IMAP:
uvx readndraft-imap-mcp doctorAdd --online to test each configured account:
uvx readndraft-imap-mcp doctor --onlineDiagnostic output never prints passwords, credential contents, raw IMAP traces, or message content. See troubleshooting.
Updating
Use the client's native marketplace/plugin update command. Plugin release, Claude manifest, Codex manifest, and pinned PyPI runtime versions are validated as one compatibility unit. Start a new session after an update, then run:
uvx readndraft-imap-mcp@latest doctor --onlineAccount metadata and OS credentials remain independent of the plugin lifecycle.
Uninstalling
Choose whether to remove only the MCP integration or all local readNdraft data. Removing client entries and skills leaves accounts, credentials, audit history, draft provenance, and attachment exchange files available for a later reinstall.
1. Remove the plugin
Use the client-native plugin uninstall command. The plugin-provided MCP and
skill disappear together. If this installation was upgraded from 0.3.x and the
one-time migration has not been run, run migrate-plugin first so no old direct
MCP entry remains. Remove a ChatGPT desktop entry separately in that client's
MCP settings.
Fully close the client afterward so active MCP leases can end and a launcher-owned broker can exit after its idle timeout.
2. Remove accounts and OS credentials
Skip this step when retaining accounts for a later reinstall. For a complete removal, list accounts and delete each alias through the interactive command:
uvx readndraft-imap-mcp@latest account list
uvx readndraft-imap-mcp@latest account delete ALIASaccount delete requires exact confirmation and removes the corresponding
password or app password from Windows Credential Manager or the Linux Secret
Service keyring. Do this before manually deleting application state; otherwise
the account metadata needed to identify a stored credential may be lost.
3. Optionally remove remaining local data
Run uvx readndraft-imap-mcp@latest doctor to display the private state path and
uvx readndraft-imap-mcp@latest attachments path to display the fixed attachment
exchange directories. Inspect them before manually removing anything. Remaining
data can include:
integrity-chained audit history;
draft provenance needed to update MCP-created drafts;
downloaded and upload-staging attachments;
the local IPC key and broker state;
an unused
approvalsdirectory left by an older build.
Remove these directories only when their audit, recovery, and attachment data is no longer needed. readNdraft does not delete them automatically.
There is no permanently installed uv tool to uninstall when readNdraft is used
only through uvx. uv may retain ordinary download/build cache entries shared
with other tools; clearing uv's global cache is not required to uninstall
readNdraft.
Security and privacy
The stdio MCP frontend cannot read the account file or OS credential store. It
communicates over authenticated per-user IPC with a separate broker that enforces
capabilities, quotas, provenance, and audit. Email and attachments are always
untrusted input. Received HTML is sanitized for rich reads while preserving
useful email structure, safe links, and a conservative set of presentation
styles; HTML-only mail is converted to plain text for normal reads. Draft HTML
is also sanitized and normalized before storage. It accepts common modern email
markup, complete HTML documents, safe links, and allowlisted CSS; stylesheet
rules are inlined for mail-client compatibility. Active content, event handlers,
unsafe URL schemes, external stylesheets, and images cause draft creation or
update to be rejected. Remote images, stylesheets, links,
or other URLs are never fetched automatically.
MCP tools never accept arbitrary local paths: draft files come only from the
readNdraft attachment input directory and downloaded attachments are written
only to its output directory. Run readndraft-imap-mcp attachments path to
locate them. save_attachment also returns the saved file's absolute path using
the MCP server host's native path format; clients must use that value verbatim.
Read SECURITY.md for the current security boundary. Security issues should not contain credentials or private mail.
Development
See CONTRIBUTING.md before proposing a change. Security reports must use the private route documented in SECURITY.md.
uv sync --extra dev
uv run pytest
uv run python scripts/security_check.py
uv build --no-sourcesRelease validation and publication steps are documented in docs/RELEASE.md.
License
readNdraft, including its packaged Agent Skill and documentation, is licensed under the Apache License 2.0. Dependency licensing is summarized in THIRD_PARTY_NOTICES.md.
Available Tools
16 toolscreate_draftB
Save a draft; authored HTML permits normal mail layout CSS but rejects remote resources, hidden content, and message-box escapes. Empty paragraphs are preserved. No send capability.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| body | Yes | ||
| subject | Yes | ||
| html_body | No | ||
| account_id | Yes | ||
| attachment_names | No | ||
| reply_to_message | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| uid | Yes | |
| mailbox | Yes | |
| draft_id | Yes | |
| account_id | Yes | |
| message_id | Yes | |
| uid_validity | Yes | |
| attachment_hashes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false, so the description must carry behavioral context. It discloses that HTML is constrained (rejects remote resources, hidden content, message-box escapes), preserves empty paragraphs, and cannot send. These details add value beyond annotations and do not contradict them. It stops short of discussing result side-effects or failure modes, but is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences in length, opens with the core action, and delivers key constraints efficiently. Every sentence adds meaningful information without repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, 0% schema coverage), the description is inadequate. It fails to explain most required and optional parameters, so an agent cannot confidently construct correct calls. The presence of an output schema doesn't compensate for missing parameter semantics. Only the HTML-related behavior is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate for all 9 parameters. It only touches on the html_body parameter through 'authored HTML' constraints and vaguely references content preservation. It offers no guidance on account_id, to, subject, body, cc, bcc, attachment_names, or reply_to_message, leaving most parameters poorly specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Save a draft' – a specific verb and resource. It also clarifies 'No send capability,' which disambiguates from any sending tool. However, it does not explicitly differentiate from the sibling 'update_draft,' so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives like update_draft. The only hint is 'No send capability,' which implicitly rules out sending but doesn't name alternatives or conditions for selection. This leaves the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailBRead-onlyIdempotent
Read safe headers/plain text using one complete returned identity.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| max_text_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| text | Yes | |
| flags | Yes | |
| headers | Yes | |
| identity | Yes | |
| attachments | Yes | |
| text_truncated | Yes | |
| text_total_chars | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool read-only and idempotent, and 'Read' is consistent with that. The description adds a useful prerequisite ('one complete returned identity') and narrows the output to safe headers/plain text, but it does not explain authentication, rate limits, or error behavior; the additional context is modest but not contradictory.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler; the read action and resource are stated first. The term 'complete returned identity' is slightly jargon-y and could be clearer, but the overall structure is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return value details are not needed here, and annotations cover the safety profile. Still, the description does not indicate which sibling/prior call produces the complete identity or how max_text_chars behaves, leaving a clear but incomplete workflow picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero schema descriptions, the phrase 'one complete returned identity' adds meaning by explaining that account_id, mailbox, uid_validity, and uid must form a single composite key returned together. It does not describe max_text_chars or the format of individual fields, so compensation for the 0% schema coverage is only partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a clear verb and resource ('Read safe headers/plain text') and limits the scope to a single returned identity, which helps distinguish it from plural/search and HTML-oriented siblings. It does not explicitly name a sibling, but the plain-text scoping is specific enough for an agent to infer the intended operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is an implied usage instruction: use this after obtaining a complete returned identity, rather than using arbitrary IDs. No alternatives or exclusions are mentioned, so the agent must infer when to prefer this over get_emails or get_email_html.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_email_htmlARead-onlyIdempotent
Read strictly filtered HTML without remote loading; empty paragraphs are preserved.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| html | Yes | |
| flags | Yes | |
| identity | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context: 'strictly filtered HTML without remote loading' discloses that remote content is not loaded (privacy/security feature), and 'empty paragraphs are preserved' indicates a specific formatting behavior. This goes beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the core purpose ('Read strictly filtered HTML'). Every word adds value: 'strictly filtered' and 'without remote loading' convey important behavioral constraints, and 'empty paragraphs are preserved' adds a specific detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (not shown in detail), which likely explains the return format, so the description doesn't need to cover that. The description covers the key behavioral aspects (filtering, no remote loading, empty paragraph preservation). Given the tool's moderate complexity (4 parameters, all required), the description is reasonably complete, though it could benefit from explaining the parameters or providing more context on when to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning. However, the description doesn't explain any of the four parameters (account_id, mailbox, uid_validity, uid). The parameter names are somewhat self-explanatory (identifying an email), but the description adds no additional semantics beyond what the schema provides. With 0% coverage, the description should have provided more detail, but the parameters are standard email identifiers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads filtered HTML from an email, specifying 'strictly filtered HTML without remote loading' and 'empty paragraphs are preserved'. It distinguishes itself from sibling tools like get_email and get_emails by focusing on HTML content with specific filtering behavior, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving HTML content with specific filtering requirements, but it doesn't explicitly state when to use this tool versus alternatives like get_email or get_emails. The context of 'strictly filtered' and 'without remote loading' suggests safety considerations, but no explicit when/when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailsBRead-onlyIdempotent
Read plain text for 1-10 exact identities with ordered partial results.
| Name | Required | Description | Default |
|---|---|---|---|
| identities | Yes | ||
| max_text_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds batch-size limits and the notion of 'ordered partial results,' but this behavior is cryptic and not explained in terms of what causes partial results or how ordering is determined.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. However, 'ordered partial results' is dense and could be clearer, so it loses a point for being overly terse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema and annotations cover return-value shape and safety, so the description does not need to repeat those. Still, for a batch read tool, an agent would benefit from more explicit guidance about when to call it versus siblings and what 'identities' refers to.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate by explaining the identities structure or max_text_chars. It only weakly hints at '1-10 exact identities' and provides no guidance on max_text_chars or the meaning of the required identity fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and resource ('plain text for 1-10 exact identities'), which makes clear this is a batch plain-text retrieval tool. It is distinguishable from the single-item get_email and HTML-focused get_email_html siblings, though 'identities' is not explicitly defined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase '1-10 exact identities' implies a batch use case and hints at a limit, and 'plain text' distinguishes this from HTML retrieval. However, the description never explicitly states when to prefer this tool over get_email or search_emails, nor does it state exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsARead-onlyIdempotent
List safe account aliases. Call this before using an unknown alias.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds a small amount of context with 'safe' and the prerequisite guidance, but does not elaborate on return characteristics, ordering, or any other behavior beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action, and every word earns its place. The prerequisite instruction is direct and adds meaningful guidance without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with a full output schema and safety-related annotations, the description is complete. It tells the agent what to call and when to call it, leaving no critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero parameters, so the description does not need to explain parameter semantics. The baseline of 4 applies because there are no parameter-related gaps to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('safe account aliases'), making it distinct enough from sibling tools like list_mailboxes. It is concise and unambiguous, though it does not explicitly differentiate itself from all siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction 'Call this before using an unknown alias' provides an explicit when-to-use recommendation. It does not mention when not to use it or compare it to alternatives, but the usage context is concrete and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_attachment_inputsARead-onlyIdempotent
List safe files available in readNdraft's fixed attachment input directory.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds context beyond those by mentioning 'safe files' and the 'fixed attachment input directory', which clarifies the source and filtering behavior. It does not contradict annotations, though 'safe' is not further explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence (12 words) that is front-loaded with the action 'List' and delivers all necessary information without wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple list operation with no parameters and an output schema available, so the description need not cover return values. The description provides the essential context (read-only, fixed directory, safe files), but leaves a minor gap by not defining what qualifies as 'safe'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description correctly omits parameter details, and the empty schema requires no additional semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and identifies a unique resource: 'safe files available in readNdraft's fixed attachment input directory'. This clearly distinguishes it from sibling tools like list_accounts or save_attachment, which target different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context through the phrase 'attachment input directory', suggesting it is used to enumerate files available for attachments. However, it gives no explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesARead-onlyIdempotent
List exact mailbox names for 1-10 accounts with isolated failures.
| Name | Required | Description | Default |
|---|---|---|---|
| account_ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds meaningful beyond-annotation context with 'isolated failures', disclosing that failures on one account do not prevent results for others. It also emphasizes 'exact' mailbox names, which hints at precision behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence that front-loads the core operation ('List exact mailbox names') and packs in the key constraints: account count and isolated failure behavior. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool with a rich annotation set and an output schema, the description covers the essential constraints: what is listed, for how many accounts, and what happens on partial failure. Nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the single parameter account_ids is largely self-explanatory. The description adds value by specifying the '1-10 accounts' count constraint and per-account isolation, but it does not detail ID format, ordering, or error semantics beyond isolation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List exact mailbox names') and scopes it clearly to '1-10 accounts'. It is immediately distinguishable from sibling tools like list_accounts, which lists accounts rather than mailbox names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool is appropriate: when you need exact mailbox names for a bounded set of 1-10 accounts. It does not name explicit alternatives or exclusion cases, but the resource and scope make the intended use apparent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emailADestructive
Move one ordinary message to an existing ordinary mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| destination_mailbox | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| method | Yes | |
| identity | Yes | |
| destination_mailbox | Yes | |
| destination_identity | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the agent knows this is a destructive write. The description adds the constraints that the destination must already exist ('existing') and that the message/mailbox are 'ordinary' (not special types), providing some extra context. However, it does not disclose details about source deletion or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly worded sentence that front-loads the core purpose without filler. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the annotations and output schema, the description is too sparse for a mutation tool with 5 required parameters and no parameter documentation. It lacks context on how to obtain the identifiers, the relationship between uid and uid_validity, and any prerequisites for moving an 'ordinary' message. The tool's overall behavior is underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate. It mentions 'message' and 'destination_mailbox' but does not explain the meaning or format of uid, uid_validity, mailbox, or account_id. For a tool with 5 required params including the non-obvious uid_validity, this is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Move'), the resource ('one ordinary message'), and the destination ('an existing ordinary mailbox'). The word 'one' distinguishes it from the batch sibling move_emails_batch, making its sole purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The singular 'one' implies this tool is for single-message moves, suggesting batch moves should go elsewhere, but it does not explicitly name alternatives or state when not to use this tool. The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emails_batchADestructive
Move 1-50 ordinary messages from one account to one mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| identities | Yes | ||
| destination_mailbox | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: it specifies the batch size limit (1-50), restricts messages to 'ordinary' types, and clarifies that all messages must originate from one account and go to one mailbox. This complements the destructiveHint annotation without contradicting it, though it does not mention potential partial failures or atomicity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core action and key constraints without any fluff. Every word carries meaning, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (batch operation, 2 parameters, output schema present), the description covers the essential selection criteria: what it does, batch limits, and account/mailbox constraints. However, it leaves some ambiguity around 'ordinary messages' and does not address error handling or atomicity, which would be helpful but is not critical given the annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining that 'identities' represents the 1-50 messages to move (all from one account) and 'destination_mailbox' is the target mailbox. This adds crucial meaning that the schema property names alone do not convey, and it aligns with the required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Move'), the resource ('ordinary messages'), and the scope ('1-50', 'from one account to one mailbox'). It also implicitly distinguishes itself from the sibling tool 'move_email' by specifying batch size, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for batch moves of 1-50 messages, but it does not explicitly state when to use this tool versus the single-message sibling 'move_email' or any other alternative. There is no mention of exclusions or conditions, so guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_attachmentCRead-onlyIdempotent
Save one attachment; saved_path is its absolute native-platform location.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| attachment_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| size | Yes | |
| sha256 | Yes | |
| saved_name | Yes | |
| saved_path | No | |
| content_type | Yes | |
| original_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation declares readOnlyHint=true, but the description says 'Save one attachment,' implying a write operation to the filesystem. This is a direct contradiction, and the description does not clarify the tool's side effects, permissions, or overwriting behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that conveys the core function and a key output detail. It is efficient and well-structured, though it omits critical behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool requires 5 parameters, has no parameter descriptions, and includes a contradictory annotation, the description is far from complete. It does not address usage context, side effects, or parameter relationships, making it inadequate for reliable tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 5 required parameters with 0% description coverage. The description does not explain the role of any parameter, relying solely on parameter names. This is insufficient for an agent to understand how to correctly populate the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool saves one attachment and specifies that saved_path is the absolute native-platform location. This clearly defines the tool's action and distinguishes it from sibling tools like list_attachment_inputs or get_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It only describes the action without contextualizing its usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsARead-onlyIdempotent
Search 1-500 metadata rows in stable mailbox order with optional paging.
| Name | Required | Description | Default |
|---|---|---|---|
| read | No | ||
| text | No | ||
| after | No | ||
| limit | No | ||
| before | No | ||
| cursor | No | ||
| fields | No | ||
| sender | No | ||
| starred | No | ||
| subject | No | ||
| targets | Yes | ||
| recipient | No | ||
| attachment_filename | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| order | Yes | |
| errors | Yes | |
| results | Yes | |
| truncated | Yes | |
| next_cursor | Yes | |
| targets_pending | Yes | |
| targets_searched | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, and non-destructive behavior. The description adds non-obvious operational context: results are metadata only, limited to 1-500 rows, returned in stable mailbox order, and paging is optional. This goes beyond the safety profile already captured by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with no wasted words; the core operational facts are front-loaded and easy to parse. Despite its brevity, it conveys scope, result bound, ordering, and paging.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Annotations and output schema cover safety and return shape, but the high-complexity 13-parameter input schema with a required nested targets object is largely undocumented. The description is minimally adequate but leaves an agent to infer filter combination and pagination mechanics from parameter names alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for 13 parameters. It only hints at paging and the 1-500 row limit, leaving required targets, filter semantics, field selection, and cursor usage unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: searching email metadata rows, bounded to 1-500, with stable order and optional paging. 'Metadata rows' helps distinguish it from sibling get_email and get_emails tools, though it does not name those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended usage is implied: use this tool when searching metadata rows with paging, rather than retrieving full email bodies. However, no explicit when-to-use, when-not-to-use, or alternative tool comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_read_stateCIdempotent
Set one read state idempotently.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| read | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | Yes | |
| changed | Yes | |
| enabled | Yes | |
| identity | Yes | |
| new_flags | Yes | |
| old_flags | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true, readOnlyHint=false, and destructiveHint=false. The description's 'idempotently' repeats the annotation, and the word 'one' adds minimal scoping context. It does not disclose additional behaviors like auth requirements or response semantics, but it does not contradict the annotations either.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler and front-loaded purpose. However, it is almost too sparse, functioning as a fragment rather than a complete thought, which slightly reduces clarity despite its efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 required parameters, including IMAP-specific uidd_validity concepts, no schema descriptions, and the existence of a batch sibling, the description is insufficient. It does not explain how to identify the message or when to prefer the single vs batch variant, leaving the tool under-documented for reliable use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description explains none of the 5 parameters. Terms like uid_validity and mailbox are left undefined, so the description fails to compensate for the sparse schema and offers little meaning beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Set one read state idempotently.' uses a specific verb 'Set' and a clear resource 'read state', making the operation obvious. The word 'one' distinguishes it from the batch sibling set_read_state_batch, although it does not explicitly name the alternative, so it falls short of perfect sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus set_read_state_batch or set_star. The singular 'one' implies a single-message use case, but there is no explicit context about prerequisites, exclusions, or alternatives, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_read_state_batchAIdempotent
Set one read state for 1-50 identities.
| Name | Required | Description | Default |
|---|---|---|---|
| read | Yes | ||
| identities | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose idempotent and non-read-only nature. The description adds the constraint that a single read state is applied to all identities, and the batch size limit. It does not discuss failure modes or whether the operation is atomic, but the annotations reduce the burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the core operation without any wasted words. Every word contributes to meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description minimally covers the operation but lacks details on batch semantics (e.g., whether partial failures occur) or when to choose this over the singular set_read_state. The output schema exists, so return values are covered, but overall the tool is underspecified for a batch mutation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It loosely maps 'read state' to the 'read' parameter and 'identities' to the identity array, but does not clarify that 'read' is a boolean (true/false) or describe the structure of identity objects. Significant gaps remain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Set'), the resource ('read state for identities'), and the batching scope ('1-50 identities'). It distinguishes from the singular sibling set_read_state by indicating the batch capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The range '1-50 identities' gives clear context for when to use this batch version over the singular sibling. However, it does not explicitly mention alternatives or exclusion cases, so it misses the highest level of guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_starCIdempotent
Set one starred state idempotently.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| starred | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | Yes | |
| changed | Yes | |
| enabled | Yes | |
| identity | Yes | |
| new_flags | Yes | |
| old_flags | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description says "idempotently," which merely repeats the idempotentHint annotation. It adds no new behavioral context such as authentication requirements, error behavior, or the effect on other email metadata. Since annotations already declare idempotency and non-read-only status, the description adds minimal value beyond structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It is front-loaded with the operation (Set) and immediate qualifiers (one starred state, idempotently). Structurally, it is as concise as possible for the content it provides.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five required parameters and no parameter documentation, the description is grossly incomplete. It lacks any mention of how to identify the target email, what the starred value means, or how to handle the response. While annotations cover idempotency and write behavior, they do not compensate for missing parameter context and usage instructions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides zero explanation of the five parameters (account_id, mailbox, uid_validity, uid, starred). It does not indicate how these parameters relate to the email being starred, what the starred boolean controls, or how uid_validity is used. The tool is unusable without schema-level or description-level parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool sets one starred state, using the verb "Set" with a specific resource ("one starred state"). The qualifier "one" distinguishes it from the sibling set_star_batch, and "starred" separates it from set_read_state. While terse, it conveys the exact operation and primary scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like set_star_batch or set_read_state. The description does not mention batch operations, read-state operations, or any exclusions or prerequisites, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_star_batchBIdempotent
Set one starred state for 1-50 identities.
| Name | Required | Description | Default |
|---|---|---|---|
| starred | Yes | ||
| identities | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds only the 1-50 batch limit; it does not disclose behavior on partial failures, return format, or whether existing star states are overwritten. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, succinct sentence with no redundant words. It is front-loaded with the action and scope, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a nested object array and boolean parameter, the description is under-specified. It lacks context about uniform state application, error behavior, relationship to set_star, and what constitutes an identity. The output schema exists but does not substitute for usage clarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It hints at the 'starred' boolean ('one starred state') and mentions the identities array with a count bound, but it does not explain the structure of identity objects, the uniform application of the state, or the meaning of each parameter beyond what the schema types imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Set'), the resource ('starred state'), and the scope ('identities', 1-50). It conveys batch behavior and distinguishes from the singular set_star tool via the count limit, though it does not explicitly mention the sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this batch tool versus alternatives like set_star or set_read_state_batch. It does not mention prerequisites, exclusions, or a recommended context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_draftBDestructive
Replace a draft; authored HTML permits normal mail layout CSS but rejects remote resources, hidden content, and message-box escapes. Empty paragraphs are preserved. No send capability.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| body | Yes | ||
| subject | Yes | ||
| draft_id | Yes | ||
| html_body | No | ||
| account_id | Yes | ||
| attachment_names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| uid | Yes | |
| method | Yes | |
| mailbox | Yes | |
| draft_id | Yes | |
| account_id | Yes | |
| message_id | Yes | |
| uid_validity | Yes | |
| attachment_hashes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark destructiveHint=true, and the description aligns by saying 'Replace a draft'. It adds valuable behavioral detail: HTML restrictions (permits normal layout CSS but rejects remote resources, hidden content, message-box escapes) and that empty paragraphs are preserved. It also clarifies it cannot send emails – useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, with the primary purpose front-loaded. It adds only relevant details about HTML constraints and capabilities, with no verbosity. Every sentence earns its place, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 9 parameters and 0% schema coverage, the description is thin. It covers purpose and HTML constraints but omits parameter semantics, required field explanations, and side effects beyond replacement. The presence of an output schema doesn't offset the missing parameter guidance, so completeness is low.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it provides no information about any of the 9 parameters. It mentions 'authored HTML' but does not tie it to the html_body parameter. Required parameters like account_id, draft_id, to, subject, body are unexplained, leaving the agent without guidance on how to construct a valid call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Replace a draft' – a specific verb and resource. It clarifies scope with HTML constraints and 'No send capability', which helps distinguish from send-related tools. However, it does not explicitly name siblings like create_draft, though 'replace' implies updating an existing draft.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance is provided. The description implies use for updating existing drafts rather than creating new ones, but does not state conditions or alternatives. It also omits prerequisites like having a draft_id, so an agent must infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v0.9.0- Changed
get_email4 fields changed- added
Input schema / properties / max_text_charsAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Max Text Chars" +} - added
Output schema / properties / text_total_charsAdded value: +{ + "title": "Text Total Chars", + "type": "integer" +} - added
Output schema / properties / text_truncatedAdded value: +{ + "title": "Text Truncated", + "type": "boolean" +} - changed
Output schema / requiredPrevious value: -[ - "identity", - "headers", - "text", - "flags", - "attachments" -]New value: +[ + "identity", + "headers", + "text", + "flags", + "attachments", + "text_total_chars", + "text_truncated" +]
- Changed
get_emails4 fields changed- added
Input schema / properties / max_text_charsAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Max Text Chars" +} - added
Output schema / $defs / MessageOutput / properties / text_total_charsAdded value: +{ + "title": "Text Total Chars", + "type": "integer" +} - added
Output schema / $defs / MessageOutput / properties / text_truncatedAdded value: +{ + "title": "Text Truncated", + "type": "boolean" +} - changed
Output schema / $defs / MessageOutput / requiredPrevious value: -[ - "identity", - "headers", - "text", - "flags", - "attachments" -]New value: +[ + "identity", + "headers", + "text", + "flags", + "attachments", + "text_total_chars", + "text_truncated" +]
- Changed
list_mailboxes5 fields changed- removed
Input schema / properties / account_idRemoved value: -{ - "title": "Account Id", - "type": "string" -} - added
Input schema / properties / account_idsAdded value: +{ + "items": { + "type": "string" + }, + "title": "Account Ids", + "type": "array" +} - changed
Input schema / requiredPrevious value: -[ - "account_id" -]New value: +[ + "account_ids" +] - added
Output schema / $defs / MailboxBatchOutputAdded value: +{ + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Error" + }, + "mailboxes": { + "items": { + "$ref": "#/$defs/MailboxOutput" + }, + "title": "Mailboxes", + "type": "array" + }, + "ok": { + "title": "Ok", + "type": "boolean" + } + }, + "required": [ + "account_id", + "ok", + "mailboxes", + "error" + ], + "title": "MailboxBatchOutput", + "type": "object" +} - changed
Output schema / properties / result / items / $refPrevious value: -"#/$defs/MailboxOutput"New value: +"#/$defs/MailboxBatchOutput"
- Changed
search_emails5 fields changed- added
Input schema / $defsAdded value: +{ + "SearchTargetInput": { + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "mailbox": { + "title": "Mailbox", + "type": "string" + } + }, + "required": [ + "account_id", + "mailbox" + ], + "title": "SearchTargetInput", + "type": "object" + } +} - removed
Input schema / properties / accountsRemoved value: -{ - "items": { - "type": "string" - }, - "title": "Accounts", - "type": "array" -} - removed
Input schema / properties / mailboxesRemoved value: -{ - "anyOf": [ - { - "items": { - "type": "string" - }, - "type": "array" - }, - { - "type": "null" - } - ], - "default": null, - "title": "Mailboxes" -} - added
Input schema / properties / targetsAdded value: +{ + "items": { + "$ref": "#/$defs/SearchTargetInput" + }, + "title": "Targets", + "type": "array" +} - changed
Input schema / requiredPrevious value: -[ - "accounts" -]New value: +[ + "targets" +]
2 tool updates
v0.7.0- Changed
create_draft2 fields changed- added
Input schema / $defsAdded value: +{ + "IdentityOutput": { + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "mailbox": { + "title": "Mailbox", + "type": "string" + }, + "uid": { + "title": "Uid", + "type": "string" + }, + "uid_validity": { + "title": "Uid Validity", + "type": "string" + } + }, + "required": [ + "account_id", + "mailbox", + "uid_validity", + "uid" + ], + "title": "IdentityOutput", + "type": "object" + } +} - added
Input schema / properties / reply_to_messageAdded value: +{ + "anyOf": [ + { + "$ref": "#/$defs/IdentityOutput" + }, + { + "type": "null" + } + ], + "default": null +}
- Changed
list_accounts1 field changed- added
Output schema / $defs / AccountOutput / properties / sender_nameAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Sender Name" +}
2 tool updates
v0.5.0- Changed
create_draft1 field changed- added
Input schema / properties / html_bodyAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Html Body" +}
- Changed
update_draft1 field changed- added
Input schema / properties / html_bodyAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Html Body" +}
4 tool updates
v0.3.0- Changed
list_accounts1 field changed- added
Output schema / $defs / AccountOutput / properties / sender_addressAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Sender Address" +}
- Added
move_email - Added
move_emails_batch - Changed
save_attachment1 field changed- added
Output schema / properties / saved_pathAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Saved Path" +}
14 tool updates
v0.1.4- First observed
create_draft - First observed
get_email - First observed
get_email_html - First observed
get_emails - First observed
list_accounts - First observed
list_attachment_inputs - First observed
list_mailboxes - First observed
save_attachment - First observed
search_emails - First observed
set_read_state - First observed
set_read_state_batch - First observed
set_star - First observed
set_star_batch - First observed
update_draft
TDQS
Most tools are cleanly separated by resource and action, with batch variants clearly marked. The main ambiguity is between get_email, get_emails, and get_email_html, though their descriptions are sufficient to distinguish plain-text retrieval from HTML retrieval.
All tool names follow a consistent lowercase snake_case verb_noun pattern, such as list_mailboxes, search_emails, create_draft, and move_email. Batch operations consistently use a _batch suffix, making the naming predictable and easy to navigate.
At 16 tools, the set is slightly above the ideal 3-15 range, but the extra tools are largely justified by single-vs-batch variants and separate HTML retrieval. The count feels a bit heavy but remains reasonable for the IMAP read/draft workflow.
The set covers listing, searching, reading plain text and HTML, attachments, draft creation/update, read/star state management, and moving messages. Minor gaps exist such as no delete, no mailbox creation/management, and no send capability, but send is explicitly out of scope and core read/draft workflows are well covered.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Read, send, file and search email in any Gmail, Microsoft 365 or IMAP mailbox, plus its calendar.
Read, search, send, organize, draft and schedule email across your inboxes from any MCP client.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
- mailOAuthcom.anymailmcp
Read, send, organize, watch email on any IMAP mailbox: Gmail, iCloud, OVH, Zoho, Fastmail + CalDAV.
1
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables LLMs to read, search, and manage emails via IMAP with secure, read-only access to email accounts.6-
- FlicenseNot gradedqualityDmaintenanceProvides MCP clients with safe local access to read, search, and send Gmail messages using token-efficient outputs and explicit permissions.-
- FlicenseNot gradedqualityBmaintenanceEnables Claude to read, search, draft, send, flag, and move email across multiple IMAP/SMTP mailboxes while keeping credentials local.-
- FlicenseNot gradedqualityCmaintenanceProvides tools to manage work email: list/search/get emails and draft replies via IMAP, without sending any messages.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/LeoPhoenixT/readNdraft-imap-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server