outlook-mcp
Outlook Assistant connects AI assistants to your Microsoft Outlook account through the Model Context Protocol. Ask your AI assistant to search your inbox, send emails, schedule meetings, manage contacts, and configure mailbox settings — without leaving the conversation. Works with Claude, Cursor, Windsurf, and any MCP-compatible client.
Works with personal Outlook.com and work/school Microsoft 365 accounts.
What you can do
📨 Search and read emails — find messages by sender, subject, date, or keywords; read full threads with conversation grouping; batch flag, move, export, or categorise multiple emails at once
🛡️ Send emails with safety controls — dry-run preview, pre-send mail tips (out-of-office, mailbox full, delivery restrictions), session rate limiting, and recipient allowlist to prevent mistakes
✏️ Draft emails for review — create, update, and send drafts; reply and forward as drafts; preview before saving with dry-run mode
📅 Manage your calendar — view upcoming events, schedule meetings with attendees, decline or cancel invitations
📦 Export emails — save individual messages to Markdown, EML, JSON, or CSV; export full conversation threads to MBOX or HTML; bulk-export search results in one call
🔍 Investigate email headers — full raw header access (DKIM, SPF, DMARC, delivery chain, X-Mailer, X-Originating-IP) for phishing investigation and compliance review
🗂️ Organise your inbox — create folders, set up inbox rules, colour-code with categories, manage Focused Inbox — all work together for complete inbox automation
🔄 Track inbox changes — delta sync detects new, modified, and deleted emails since your last check, with tokens for incremental polling
👥 Manage contacts — search your contact book and organisational directory, create and update contact records
⚙️ Configure settings — set out-of-office auto-replies, working hours, and time zone
📬 Access shared mailboxes — read team inboxes and service accounts (Microsoft 365)
🏢 Find meeting rooms — search by building, floor, capacity, AV equipment, and wheelchair accessibility (Microsoft 365)
Why Outlook Assistant?
Without Outlook Assistant | With Outlook Assistant |
Switch between your AI tool and Outlook to manage email | Read, search, send, and export emails directly from your AI assistant |
Manually search and export email threads | Full email tools including search, threading, and bulk export |
Context-switch for calendar and contacts | Manage calendar events, contacts, and settings in one place |
Copy-paste email content into conversations | Your AI assistant reads your emails natively with full context |
No programmatic access to mailbox rules or categories | Create inbox rules, manage categories, configure auto-replies |
Manually check each email for phishing red flags | Forensic header analysis — DKIM, SPF, DMARC, spam scores, and delivery chain in one call |
Poll your inbox to check for new mail | Delta sync returns only changes since your last check, with tokens for continuous polling |
Features
Module | Tools | What You Can Do |
8 |
| |
Calendar | 3 |
|
Contacts | 2 |
|
Categories | 3 |
|
Settings | 1 |
|
Folder | 1 |
|
Rules | 1 |
|
Advanced | 2 |
|
Auth | 1 |
|
22 tools total — consolidated from 55 for optimal AI performance. See the Tools Reference for complete parameter details.
Export Formats
Format support varies by target:
Format | Extension |
|
|
|
|
| ✅ | – | ✅ |
|
| – | – | ✅ |
|
| ✅ | ✅ | ✅ |
|
| ✅ | ✅ | ✅ |
|
| – | – | ✅ |
|
| ✅ | ✅ | ✅ |
Export individual emails, search results, or entire conversation threads — use target=messages with a search query (or the query shortcut) to batch-export without manually collecting IDs.
Related MCP server: outlook-mcp
Account Compatibility
Outlook Assistant works with both personal and work/school Microsoft accounts, but some features behave differently:
Feature | Personal (Outlook.com) | Work/School (Microsoft 365) |
Email read, send, search | Full support | Full support |
Calendar events | Full support | Full support |
Contacts CRUD | Full support | Full support |
Inbox rules | Full support | Full support |
Folders | Full support | Full support |
Free-text | Limited — use | Full KQL support |
Categories | Full support | Full support |
Mailbox settings | Full support | Full support |
Focused Inbox | API works (overrides stored) but mail routing not affected | Full support |
Shared mailboxes | Not available | Requires |
Meeting room search | Not available | Requires |
Note: On personal accounts, Microsoft's
$searchAPI has limited support for free-text queries. Outlook Assistant handles this automatically with progressive search — if your query returns no results, it falls back through OData filters, boolean filters, and recent message listing to find your emails. For the most direct results on personal accounts, use the structured filter parameters (from,subject,to,receivedAfter).
What Makes This Different
Progressive search — on accounts where Microsoft's
$searchAPI is limited, Outlook Assistant automatically falls back through up to 4 search strategies to find your emails. Most Graph API wrappers fail silently; this one adapts.Email forensics — raw header access for DKIM, SPF, DMARC, delivery chain, X-Mailer, X-Originating-IP, and spam scores. Returns the full data so you can investigate phishing, audit compliance, or trace delivery issues. (Auto-verdict is on the v3.8.0 roadmap; today the data is surfaced and analysed in-conversation.)
Delta sync — incremental inbox monitoring returns only what changed since your last check, with tokens for continuous polling. Designed for agent workflows that need to watch a mailbox.
Batch operations — flag, move, export, or categorise multiple emails in a single call. Search-driven export lets you batch-export results without collecting IDs manually.
Pre-send intelligence — check recipients for out-of-office, full mailbox, delivery restrictions, and moderation status before sending — no other Outlook MCP server offers this.
Compound automation — rules, categories, folders, and Focused Inbox work together. Set up complete inbox management through your AI assistant in one conversation.
Safety & Token Efficiency
Outlook Assistant is designed with safety-first principles for AI-driven email access:
Destructive action safeguards — Every tool carries MCP annotations (readOnlyHint, destructiveHint, idempotentHint) so AI clients can auto-approve safe reads and prompt for confirmation on destructive operations like sending email or deleting events.
Send-email protections — The send-email tool includes:
Pre-send mail tips (
checkRecipients: true) — check recipients for out-of-office, mailbox full, delivery restrictions before sendingDry-run mode (
dryRun: true) — preview composed emails without sendingSession rate limiting — configurable via
OUTLOOK_MAX_EMAILS_PER_SESSION(default: unlimited)Recipient allowlist — restrict sending to approved addresses/domains via
OUTLOOK_ALLOWED_RECIPIENTS
Recommended setup: enable both safety belts in your
.mcp.jsonfrom day one. They're off by default;auth action=aboutreports their state and prints a setup hint when unset. See.mcp.json.examplefor a copy-paste template."env": { "OUTLOOK_CLIENT_ID": "…", "OUTLOOK_CLIENT_SECRET": "…", "OUTLOOK_MAX_EMAILS_PER_SESSION": "10", "OUTLOOK_ALLOWED_RECIPIENTS": "your-domain.com,trusted@example.com" }
Draft protections — The draft tool shares send-email safety controls: dry-run preview, recipient allowlist, mail-tips validation, and rate limiting. The send action shares the send-email rate limit counter, preventing circumvention via the draft-then-send pathway.
Token-optimised architecture — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 22 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
Important: These safeguards are defence-in-depth measures that reduce risk, but they are not a guarantee against unintended actions. AI-driven access to your email is inherently sensitive — always review tool calls before approving, particularly for sends and deletes. No automated guardrail is foolproof, and you remain responsible for actions taken through your mailbox.
Quick Start
1. Install
npm install -g @littlebearapps/outlook-assistantOr run directly without installing:
npx @littlebearapps/outlook-assistant2. Register an Azure App
You need a Microsoft Azure app registration to authenticate. See the Azure Setup Guide for a detailed walkthrough (including first-time Azure account creation), or if you've done this before:
Create a new app registration at portal.azure.com
Add Microsoft Graph delegated permissions (Mail, Calendar, Contacts)
Create a client secret and copy the Value (not the Secret ID)
Under Authentication > Add a platform > Mobile and desktop applications — check
nativeclientURIEnable "Allow public client flows" in Authentication > Advanced settings
(Optional) Set redirect URI to
http://localhost:3333/auth/callback— only needed for browser auth flow
3. Configure Your MCP Client
Add to your MCP client config:
{
"mcpServers": {
"outlook": {
"command": "npx",
"args": ["@littlebearapps/outlook-assistant"],
"env": {
"OUTLOOK_CLIENT_ID": "your-application-client-id",
"OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
}
}
}
}claude mcp add outlook -- npx @littlebearapps/outlook-assistantThen set environment variables in your .env or shell.
Or add manually to .cursor/mcp.json:
{
"mcpServers": {
"outlook": {
"command": "npx",
"args": ["@littlebearapps/outlook-assistant"],
"env": {
"OUTLOOK_CLIENT_ID": "your-application-client-id",
"OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
}
}
}
}{
"mcpServers": {
"outlook": {
"command": "npx",
"args": ["@littlebearapps/outlook-assistant"],
"env": {
"OUTLOOK_CLIENT_ID": "your-application-client-id",
"OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
}
}
}
}4. Authenticate
Start the auth server:
outlook-assistant-auth(ornpx @littlebearapps/outlook-assistant-auth)In your AI assistant, use the
authtool withaction=authenticateto get an OAuth URLOpen the URL, sign in with your Microsoft account, and grant permissions
Tokens are saved locally and refresh automatically
Note: The auth server needs
OUTLOOK_CLIENT_IDandOUTLOOK_CLIENT_SECRETenvironment variables. Your MCP client's"env"config only applies to the MCP server process — when running the auth server separately, ensure these are set in a.envfile or exported in your shell.
Installation
Prerequisites
Node.js 18.0.0 or higher
npm (included with Node.js)
Azure account for app registration (free tier works)
From npm (recommended)
npm install -g @littlebearapps/outlook-assistantFrom source
git clone https://github.com/littlebearapps/outlook-assistant.git
cd outlook-assistant
npm installAzure App Registration
First time with Azure? The Azure Setup Guide covers everything from creating an account to your first authentication, including billing setup and common pitfalls.
Create the App
Open Azure Portal
Sign in with a Microsoft Work or Personal account
Search for App registrations and click New registration
Enter a name (e.g. "Outlook Assistant Server")
Select Accounts in any organizational directory and personal Microsoft accounts
Set redirect URI: platform Web, URI
http://localhost:3333/auth/callbackClick Register
Copy the Application (client) ID
Add Permissions
Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions
Add these required permissions:
offline_access— refresh tokens between sessionsUser.Read— basic profileMail.Read,Mail.ReadWrite,Mail.Send— email operationsCalendars.Read,Calendars.ReadWrite— calendar operationsContacts.Read,Contacts.ReadWrite— contact managementMailboxSettings.ReadWrite— settings, auto-replies, categoriesPeople.Read— people search
Optionally add org-only permissions (work/school accounts only):
Mail.Read.Shared— shared mailbox accessPlace.Read.All— meeting room search (requires admin consent)
Click Add permissions
Create a Client Secret
Go to Certificates & secrets > New client secret
Enter a description and select expiration
Click Add
Copy the secret Value immediately — you won't be able to see it again. Use the Value, not the Secret ID.
Configuration
Environment Variables
Create a .env file from the example:
cp .env.example .envEdit with your Azure credentials:
OUTLOOK_CLIENT_ID=your-application-client-id
OUTLOOK_CLIENT_SECRET=your-client-secret-VALUE
USE_TEST_MODE=falseNote: The server also accepts
MS_CLIENT_IDandMS_CLIENT_SECRETfor backwards compatibility.
MCP Client Configuration
See Quick Start — Configure Your MCP Client above for Claude Desktop, Claude Code, Cursor, and Windsurf configs.
If installed from source, use node instead of npx:
{
"mcpServers": {
"outlook": {
"command": "node",
"args": ["/path/to/outlook-assistant/index.js"],
"env": {
"OUTLOOK_CLIENT_ID": "your-application-client-id",
"OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
}
}
}
}Authentication Flow
Device Code Flow (Default — Recommended)
No auth server needed. Works everywhere, including remote/headless environments.
Ask your AI assistant to authenticate (calls
authtool withaction=authenticate)Visit the URL shown (
microsoft.com/devicelogin) on any browser, any deviceEnter the code, sign in with your Microsoft account, and grant permissions
Tell your AI assistant to complete authentication (calls
authwithaction=device-code-complete)Tokens are saved to
~/.outlook-assistant-tokens.jsonand refresh automatically
Prerequisite: Enable "Allow public client flows" in Azure Portal > your app > Authentication > Advanced settings.
Server restarts (v3.7.2+): Device code state is persisted to
~/.outlook-assistant-pending-auth.json, sodevice-code-completeworks even if the MCP server restarts between steps 1 and 4 (e.g., Untether/Telegram bridge, Claude Desktop session changes).
Browser Redirect Flow (Alternative)
For localhost development or if you prefer the traditional OAuth flow:
npm run auth-serverThis starts a local server on port 3333 to handle the OAuth callback.
In your AI assistant, use the
authtool withaction=authenticate, method=browserOpen the provided URL in your browser
Sign in and grant permissions — tokens are saved automatically
Note: The auth server reads
OUTLOOK_CLIENT_IDandOUTLOOK_CLIENT_SECRETfrom environment variables. Your MCP client's"env"config only applies to the MCP server process, not a separately-started auth server.
Directory Structure
outlook-assistant/
├── index.js # Main entry point (22 tools)
├── config.js # Configuration settings
├── outlook-auth-server.js # OAuth server (port 3333)
├── auth/ # Authentication module (1 tool)
├── email/ # Email module (7 tools)
│ ├── mail-tips.js # Pre-send recipient validation
│ ├── headers.js # Email header retrieval
│ ├── mime.js # Raw MIME/EML content
│ ├── conversations.js # Thread listing/export
│ ├── attachments.js # Attachment operations
│ └── ...
├── calendar/ # Calendar module (3 tools)
├── contacts/ # Contacts module (2 tools)
├── categories/ # Categories module (3 tools)
├── settings/ # Settings module (1 tool)
├── folder/ # Folder module (1 tool)
├── rules/ # Rules module (1 tool)
├── advanced/ # Advanced module (2 tools)
└── utils/
├── graph-api.js # Microsoft Graph API client (includes $batch)
├── safety.js # Rate limiting, recipient allowlist, dry-run
├── odata-helpers.js # OData query building
├── field-presets.js # Token-efficient field selections
├── response-formatter.js # Verbosity levels
└── mock-data.js # Test mode dataTroubleshooting
"Cannot find module '@modelcontextprotocol/sdk/server/index.js'"
npm install"EADDRINUSE: address already in use :::3333"
npx kill-port 3333
npm run auth-server"Invalid client secret" (AADSTS7000215)
You're using the Secret ID instead of the Secret Value. Go to Azure Portal > Certificates & secrets and copy the Value column.
Authentication URL doesn't work
If using browser flow: start the auth server first with npm run auth-server. If using device code flow: visit microsoft.com/devicelogin instead.
Device code "invalid_client"
Enable "Allow public client flows" in Azure Portal > App registrations > Authentication > Advanced settings.
Token refresh fails after ~60 minutes (device code auth)
Fixed in v3.7.2. Earlier versions sent client_secret in token refresh requests for device-code auth, which Microsoft rejects for public client flows. Update to v3.7.2+ or re-authenticate.
Empty API responses
Check authentication status with the auth tool (action=status). Tokens may have expired — re-authenticate if needed.
Development
Running Tests
npm test # Jest unit tests
npm run inspect # MCP Inspector (interactive)Test Mode
Run with mock data (no real API calls):
USE_TEST_MODE=true npm startExtending the Server
Create a new module directory (e.g.
tasks/)Implement tool handlers in separate files
Export tool definitions from the module's
index.jsImport and add tools to the
TOOLSarray in mainindex.jsAdd tests in
test/Update
docs/quickrefs/tools-reference.md
Documentation
Guide | Description |
Install, configure, and authenticate — start here | |
Azure account creation, app registration, permissions, and secrets | |
29 practical guides for email, calendar, contacts, and settings | |
Active milestones (v3.7.5, v3.8.0, v3.9.0) and recent releases | |
Common problems, re-authentication, and frequently asked questions | |
All 22 tools with parameters | |
Tool selection and workflow patterns for AI agents |
Full documentation: docs/
Known Limitations
Personal account search: Free-text
queryandkqlQueryrely on Microsoft's$searchAPI, which has limited support on personal Outlook.com accounts. Outlook Assistant mitigates this with progressive search fallback (trying OData filters automatically), but for the most direct results, use structured filters (from,subject,to,receivedAfter).Focused Inbox: Only available on work/school Microsoft 365 accounts.
Shared mailboxes: Require
Mail.Read.Sharedpermission and a work/school account.Meeting room search: Requires
Place.Read.Allpermission with admin consent (work/school accounts only).Export default path: Exports save to the system temp directory by default. Use
savePathoroutputDirto specify a different location.
Contributing
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
Security
For security concerns, please see our Security Policy. Do not open public issues for vulnerabilities.
Changelog
See CHANGELOG.md for version history.
About
Built and maintained by Little Bear Apps. Outlook Assistant is open source under the MIT License.
Available Tools
22 toolsapply-categoryA
Tag or untag email messages with master categories (those created via manage-category). action=set (default) replaces the message's category set with the supplied categories array. action=add appends categories to whatever's already on the message. action=remove removes only the named categories, leaving the rest. Accepts either messageId (single) or messageIds (batch via Graph $batch). categories are matched by display name — names must already exist in the master list (create via manage-category first). Returns per-message confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | set (replace all), add (append), remove (remove specific). Default: set | |
| messageId | No | Single message ID to categorise | |
| categories | Yes | Category display names to apply/remove (required) | |
| messageIds | No | Array of message IDs to categorise (batch operation) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations (readOnlyHint=false, destructiveHint=false) by detailing exact mutation semantics: `set` replaces, `add` appends, `remove` removes only named categories. It also discloses the matching-by-display-name behavior, the Graph `$batch` mechanism, and the per-message confirmation return, all of which are non-obvious and useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences long, each earning its place. It starts with the core purpose, then explains actions, parameter options, prerequisites, and return value in a logical flow. No redundant filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, no output schema, and moderate complexity, the description covers all necessary aspects: purpose, action semantics, prerequisite (categories must exist), single/batch variants, and return value. It also correctly references the sibling `manage-category` tool, making the description complete in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema already covers all parameters (100% coverage), the description adds critical meaning: it explains that `messageId` and `messageIds` are alternatives (not combinable), that `categories` are matched by display name, and that `action` defaults to `set`. This extra context enriches the parameter understanding beyond the schema's terse descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource statement: 'Tag or untag email messages with master categories.' It specifies the three actions (set, add, remove) and distinguishes itself from sibling tool `manage-category` (which creates categories). The purpose is unambiguous and specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by referencing `manage-category` as the prerequisite for creating categories and explicitly notes that category names must already exist in the master list. It also explains single vs. batch usage. It doesn't explicitly list alternative tools for 'when not to use this', but the workflow context is strong enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attachmentsA
Inspect or retrieve email attachments. action=list (default) returns metadata for all attachments on messageId (id, name, contentType, size, isInline) — read-only. action=view returns inline content for text/JSON/XML attachments via attachmentId; binary types require download. action=download saves the attachment to disk at outputDir (default system tmpdir, auto-created) and returns the saved file path. messageId is required for all actions; attachmentId is required for view/download. Use outputVerbosity to control list field count.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Action to perform (default: list) | |
| savePath | No | DEPRECATED alias for `outputDir`. Will be removed in a future release. | |
| messageId | Yes | Email message ID (required) | |
| outputDir | No | Directory to save file (action=download, default: system tmpdir). Auto-created if missing. | |
| attachmentId | No | Attachment ID (action=view/download, required) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses that list is read-only, view retrieves content, and download saves to disk. It also notes auto-creation of outputDir and behavior for binary types. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficient (~100 words), front-loads the core purpose, and uses clear structure (action=...). Every sentence conveys essential information without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all three actions, parameter requirements, and edge cases (binary types, directory creation). However, it does not specify the exact return format for the list action, though it lists metadata fields. Missing output schema is partly offset.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value by specifying defaults (system tmpdir for outputDir), auto-creation, deprecation of savePath, and requirement of attachmentId for view/download, going beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Inspect or retrieve email attachments' and enumerates three distinct actions (list, view, download) with specific purposes. It differentiates from sibling tools like read-email by focusing solely on attachments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use each action (e.g., 'view returns inline content for text/JSON/XML attachments; binary types require download'). However, it does not explicitly state when not to use this tool or mention alternatives among sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authA
Manage authentication with the Microsoft Graph API. action=status (default) returns the current auth state and auto-refreshes the access token if it's expired but the refresh token is still valid (~90-day window) — call this first to check before other tools. action=authenticate starts the OAuth flow: with method: "device-code" (default, works headlessly) it returns a code + URL for the user to visit; with method: "browser" it opens the local auth server on :3333 (run npm run auth-server first). Pass force: true to re-authenticate over an existing valid session. action=device-code-complete finishes device-code auth after the user enters the code in their browser — call this once authentication shows as successful in the browser. action=about returns server version, configured audience, scope list, and other diagnostic info. Tokens persist to ~/.outlook-assistant-tokens.json and survive server restarts.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Force re-authentication even if already authenticated (action=authenticate only) | |
| action | No | Action to perform (default: status) | |
| method | No | Auth method for action=authenticate. device-code (default): no auth server needed, works remotely. browser: traditional OAuth redirect via port 3333. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond the minimal annotations: auto-refresh of expired access tokens within a ~90-day window, token persistence to a specific file across restarts, the need to run a local server for browser auth, and the effect of `force: true` on an existing session. There is no contradiction with the annotations (readOnlyHint=false, destructiveHint=false).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every sentence earns its place, covering all four actions, defaults, prerequisites, and persistence in a compact, logically ordered paragraph. It uses semicolons and clauses to group related information, making it dense but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action auth tool with no output schema, the description is remarkably complete. It describes what each action returns or does, prerequisites (npm run auth-server), failure/success flow (device-code-complete after browser entry), and persistence behavior. The agent has enough context to use the tool correctly without external documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description enhances the schema by stating defaults (`action=status`, `method=device-code`), explaining the behavior tied to `force`, and describing the distinct outcomes of each `action` value. It also clarifies the meaning of `method` options (headless vs. local server), adding value beyond raw parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Manage authentication with the Microsoft Graph API' and enumerates the four specific actions (status, authenticate, device-code-complete, about). It is easily distinguishable from the sibling email/calendar tools, and the action list gives a precise map of what the tool accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when to use this tool: 'call this first to check before other tools.' It also gives conditional guidance for each action—e.g., use device-code for headless environments, run `npm run auth-server` before using the browser method, and call device-code-complete after the user enters the code. This is strong, actionable usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create-eventA
Create a new calendar event on the signed-in user's default calendar. Returns the created event with its id, webLink, and (if attendees are present) an auto-generated online-meeting URL — attendees receive invitations on save. Times use the configured timezone (default Australia/Melbourne; override with OUTLOOK_DEFAULT_TIMEZONE); omit the Z suffix to send local time. Use manage-event action=update to modify an event after creation, or manage-event action=cancel/delete to remove it.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | The end time of the event in ISO 8601 format | |
| body | No | Optional body content for the event | |
| start | Yes | The start time of the event in ISO 8601 format | |
| subject | Yes | The subject of the event | |
| attendees | No | List of attendee email addresses |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses that attendees receive invitations on save, returns id/webLink/online-meeting URL, and explains timezone behavior (omit Z suffix for local time). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action, then provides key details in two additional sentences. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description covers return values (id, webLink, online-meeting URL). Timezone and attendee behavior are explained. With rich schema and annotations, the description is fully adequate for correct tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions. The description adds extra context: attendees trigger invitations, timezone override via environment variable, and the Z suffix convention, enhancing understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Create a new calendar event on the signed-in user's default calendar', clearly identifying the verb and resource. It distinguishes from sibling tools like manage-event which handles updates and cancellations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance: 'Use manage-event action=update to modify... or manage-event action=cancel/delete to remove it'. It also explains timezone handling with a default and override option.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
draftADestructive
Full draft lifecycle for review-before-send workflows (destructive: covers send and delete). action=create saves a new draft in the Drafts folder and returns its id (use dryRun: true to preview without saving; checkRecipients: true runs mail-tips first). action=update patches an existing draft by id (only fields passed are changed). action=send dispatches an existing draft — shares the rate limit with send-email. action=delete removes a draft permanently. action=reply/reply-all creates a reply draft from a message id (use comment to prepend text — mutually exclusive with body). action=forward creates a forward draft (requires id and to). Recipient allowlist applies to create/update/forward. Returns the draft object on create/update/reply/forward; status confirmation on send/delete.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Comma-separated CC email addresses | |
| id | No | Draft or message ID. Required for update/send/delete/reply/reply-all/forward. | |
| to | No | Comma-separated recipient email addresses (optional for create/update, required for forward) | |
| bcc | No | Comma-separated BCC email addresses | |
| body | No | Email body (plain text or HTML) | |
| action | Yes | Action to perform (required) | |
| dryRun | No | Preview draft without saving (action=create only, default: false) | |
| comment | No | Comment text for reply/forward (prepended to original message). Cannot combine with body. | |
| subject | No | Email subject | |
| importance | No | Email importance (default: normal) | |
| checkRecipients | No | Check recipients for out-of-office, delivery restrictions before saving (action=create, default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint: true, and the description elaborates on behaviors such as permanent deletion, rate limit sharing for send, and mutual exclusivity of comment and body. This adds significant context beyond the annotations, with no contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a summary and then enumerates actions clearly. While every sentence adds value, it could be more structured (e.g., bulleted actions) to improve readability. Overall, it is efficient but slightly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of 11 parameters and 7 actions, the description covers all actions, their parameter requirements, return values, and special behaviors (e.g., dryRun, checkRecipients). The lack of output schema is compensated by explicit return descriptions. No critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameters have 100% schema description coverage, but the tool description adds critical context not in the schema, such as 'Cannot combine with body' for comment, 'runs mail-tips first' for checkRecipients, and 'preview without saving' for dryRun. This provides essential usage details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it covers the full draft lifecycle with seven specific actions (create, update, send, delete, reply, reply-all, forward). Each action is explicitly described with its purpose and required inputs, distinguishing it from sibling tools like send-email and read-email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on when to use each action, including dryRun and checkRecipients for create, and notes that send shares rate limit with send-email. However, it does not explicitly state when to use an alternative tool instead (e.g., using send-email directly), leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
exportA
Export emails to file formats for archival, forensics, or programmatic processing. target=message (default) exports a single email by id to savePath — accepts mime/eml/markdown/json/csv. target=messages batch-exports either an explicit emailIds array or messages matching searchQuery (or query shortcut) into outputDir — accepts markdown/json/csv. target=conversation exports a full thread by conversationId into outputDir (chronological by default; pass order: "reverse" for newest-first) — accepts eml/mbox/markdown/json/html/csv. target=mime returns raw RFC-822 MIME bytes for id (use headersOnly for just headers, base64 for encoded transport, maxSize to cap at default 1MB). includeAttachments defaults to true for single-message exports and false for batch. Format support varies by target — see the format param enum.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Email ID (target=message/mime, required) | |
| order | No | Message order (target=conversation, default: chronological) | |
| query | No | Free-text search shortcut (target=messages). Equivalent to passing searchQuery: { subject: <query> }. Convenience alias for callers used to search-emails. | |
| base64 | No | Return base64 encoded (target=mime) | |
| format | No | Export format. Valid values vary by target: target=message accepts mime/eml/markdown/json/csv (mbox and html are conversation-only). target=conversation accepts eml/mbox/markdown/json/html/csv. target=messages (batch) accepts markdown/json/csv. mime is an alias for eml (same RFC822 bytes, .eml extension on disk). | |
| target | No | Export target (default: message) | |
| maxSize | No | Max content size in bytes (target=mime, default: 1MB) | |
| emailIds | No | Email IDs to export (target=messages) | |
| savePath | No | File path or directory (target=message) | |
| outputDir | No | Output directory (target=messages/conversation, required) | |
| headersOnly | No | MIME headers only, no body (target=mime) | |
| searchQuery | No | Search query to find emails (target=messages, alternative to emailIds) | |
| conversationId | No | Conversation ID (target=conversation, required) | |
| includeAttachments | No | Include attachments (default: true for single, false for batch) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important behavioral details such as default attachment inclusion, format dependencies, and disk-writing intent (savePath, outputDir). While annotations already indicate readOnlyHint=false and destructiveHint=false, the description adds context on side effects and size limits. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose and organized by target, but it is somewhat lengthy. However, every sentence adds necessary detail for a 14-parameter tool with four modes. It is appropriately structured and not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity and lack of an output schema, the description covers all four targets, format compatibilities, defaults, and parameter usage. It lacks explicit mention of what the tool returns (e.g., file path or bytes), but it contextually implies file operations. Generally complete for the task.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the baseline is high. The description adds significant value by explaining parameter interactions (e.g., target-specific format enums, query shortcut, includeAttachments defaults), going well beyond the schema's individual descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Export emails to file formats for archival, forensics, or programmatic processing,' specifying the verb and resource. It distinguishes from sibling tools like read-email and attachments by focusing on file export rather than viewing or handling attachments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides detailed guidance on when to use each target (message, messages, conversation, mime) and explains defaults and alternatives (e.g., emailIds vs searchQuery). However, it does not explicitly contrast with sibling tools or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find-meeting-roomsARead-only
Discover bookable meeting rooms in the user's organisation via the Graph rooms endpoint (read-only). Returns room resources with displayName, emailAddress, building, floor, capacity, and bookingType — suitable for piping into create-event as attendees. Filter by query (matches name/email), building, floor, or minimum capacity. Returns empty list on personal accounts (the rooms endpoint is M365-only). Use outputVerbosity to control field count.
| Name | Required | Description | Default |
|---|---|---|---|
| floor | No | Filter by floor number | |
| query | No | Search query (room name, email) | |
| building | No | Filter by building name | |
| capacity | No | Minimum capacity required | |
| outputVerbosity | No | Output detail level (default: standard) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context beyond annotations: it specifies the endpoint (Graph rooms), read-only behavior is reinforced, and it reveals M365-only limitation and outputVerbosity impact. This gives useful behavioral insights not present in the readOnlyHint annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (three sentences) and front-loaded with purpose, then return fields, filtering, and caveats. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and read-only annotation, the description covers purpose, return fields, filtering semantics, platform limitation, and output verbosity. It provides enough context for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds semantic value by explaining that query matches name/email, capacity is 'minimum', and outputVerbosity controls field count. These clarifications go beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool discovers bookable meeting rooms via the Graph rooms endpoint, with a specific verb ('Discover') and resource ('meeting rooms'). It also distinguishes itself from siblings by focusing on room discovery and explicitly notes suitability for piping into create-event, which differentiates it from other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: it mentions piping into create-event as attendees and provides filtering options (query, building, floor, capacity). It also includes an exclusion scenario ('Returns empty list on personal accounts'), which serves as a when-not-to-use note.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
foldersADestructive
Manage mail folders (tool-level destructiveHint=true because delete permanently removes a folder; list and stats are read-only sub-actions despite the annotation). Folders can be addressed by name, by a slash-separated PATH for nested folders (e.g. Triage/Delete, Inbox/Clients/Acme, case-insensitive), or by explicit ID; list output includes each folder's full path and [id: …]. A bare name resolves a unique top-level folder first, then searches nested folders (ambiguous names return the candidates — disambiguate with a path or ID). action=list (default) returns the folder tree (toggle includeItemCounts for unread/total, includeChildren for hierarchy). action=create makes a new folder under the root, or under parentFolder (name/path) / parentFolderId, and returns its id. action=move relocates emails (emailIds) into targetFolder (name/path) or targetFolderId. action=stats returns counts (totalItemCount/unreadItemCount) for folder (name/path) or folderId, suitable for pagination planning. action=delete removes a folder (by folderName/path or folderId) and its contents — on Outlook.com the folder is moved to Deleted Items (recoverable until you empty it); M365/Exchange accounts may hard-delete per retention policy.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Name of the folder to create (action=create, required) | |
| action | No | Action to perform (default: list) | |
| folder | No | Folder name or path (inbox, sent, "Triage/Delete", etc.). Default: inbox (action=stats) | |
| emailIds | No | Comma-separated list of email IDs to move (action=move, required) | |
| folderId | No | Folder ID (action=stats/delete) | |
| folderName | No | Folder name or path to delete — resolved to ID (action=delete). Cannot delete protected folders (Inbox, Drafts, Sent, etc.) | |
| parentFolder | No | Parent folder name or path (e.g. "Clients/Acme"); default is root (action=create) | |
| sourceFolder | No | Source folder name, default is inbox (action=move) | |
| targetFolder | No | Destination folder name or path, e.g. "Triage/Delete" (action=move; or use targetFolderId) | |
| parentFolderId | No | Parent folder ID — alternative to parentFolder for unambiguous targeting (action=create) | |
| targetFolderId | No | Destination folder ID — alternative to targetFolder for unambiguous/nested targeting (action=move) | |
| includeChildren | No | Include child folders in hierarchy (action=list) | |
| outputVerbosity | No | Output detail level (action=stats, default: standard) | |
| includeItemCounts | No | Include counts of total and unread items (action=list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description richly discloses behavioral details beyond the annotations: destructive delete semantics, read-only sub-actions, name/path/ID resolution, ambiguous-name fallback, and provider-specific differences (Outlook.com vs M365/Exchange). It clarifies and extends the destructiveHint annotation without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that packs in a lot of necessary information. It's not a model of conciseness, but every sentence adds operational value given the tool's complexity. A bulleted structure might improve scannability, but the length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-parameter tool with no output schema, the description is remarkably complete. It covers all actions, addressing schemes, return values (e.g., list output includes path and [id: ...]), constraints (cannot delete protected folders), and provider behavior differences. It leaves no major operational gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema already covers all parameters, the description adds crucial semantics: how name/path/ID addressing works, case-insensitivity, path examples, and which parameters pair with which actions (e.g., parentFolder vs parentFolderId). This is far more valuable than the schema's isolated field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as managing mail folders and enumerates five specific actions (list, create, move, stats, delete), each with a distinct purpose. It differentiates from sibling email tools by focusing entirely on folder operations and provides concrete examples of addressing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Each action has explicit context: when to use it, required parameters, and defaults (e.g., 'action=list (default) returns the folder tree'). The description notes stats is 'suitable for pagination planning' and explains move/delete prerequisites. It doesn't explicitly name alternatives among sibling tools, but the scope is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get-mail-tipsARead-only
Pre-send recipient validation via Graph POST /me/getMailTips (read-only; uses the existing Mail.Read scope — no extra permissions). Returns per-recipient tips covering automatic replies (out-of-office), mailbox full status, custom admin mail tips, delivery restrictions, moderation requirements, external-vs-internal scope, max message size, and group member counts (total + external). Use ahead of send-email or draft action=create to catch issues like OOO replies or external-recipient warnings before the message goes out; send-email/draft accept checkRecipients: true to invoke this automatically. Accepts either a comma-separated string or an array of addresses; tipTypes filters which tips are requested (defaults to all).
| Name | Required | Description | Default |
|---|---|---|---|
| tipTypes | No | Comma-separated tip types to request (default: all). Options: automaticReplies, mailboxFullStatus, customMailTip, externalMemberCount, totalMemberCount, maxMessageSize, deliveryRestriction, moderationStatus, recipientScope, recipientSuggestions | |
| recipients | Yes | Email addresses to check for mail tips |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description reveals that despite using POST, the operation is read-only and requires no additional permissions ('uses the existing Mail.Read scope — no extra permissions'). It also details what the tool returns (automatic replies, mailbox full status, custom tips, etc.), adding behavioral context not present in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-structured: it starts with the core purpose and Graph endpoint, then details return contents, usage guidance, and parameter behavior. Every sentence provides useful information without redundancy or fluff, making it concise yet comprehensive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 params, no output schema), the description covers all essential context: what it does, when to use it, alternatives, parameter formats, default behavior, and the types of tips returned. It fully prepares an agent to use the tool correctly without needing additional external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage of both parameters, including detailed descriptions. The description adds value by explaining the dual input format ('Accepts either a comma-separated string or an array of addresses') and the default behavior of tipTypes ('defaults to all'), which goes beyond the schema's static descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Pre-send recipient validation via Graph POST /me/getMailTips' and distinguishes it from siblings like send-email and draft by framing it as a pre-check. It names the resource and the exact operation, making it unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'Use ahead of send-email or draft action=create to catch issues like OOO replies or external-recipient warnings before the message goes out.' It also mentions an alternative: 'send-email/draft accept checkRecipients: true to invoke this automatically,' providing clear guidance on when to use this tool vs relying on built-in checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-eventsARead-only
List upcoming calendar events for the signed-in user (read-only). Returns an array of events with id, subject, start/end, attendees, location, organiser, and webLink. Use count (default 10, max 50) to control page size; this tool does not filter — use the Outlook UI or specific date ranges via Graph for filtered queries. Each start/end is returned as a canonical UTC ISO-8601 instant (e.g. 2026-04-02T22:00:00.000Z) followed by a labelled local rendering in the configured display timezone (default Australia/Melbourne; override with OUTLOOK_DEFAULT_TIMEZONE) — the UTC value is authoritative, so consumers never have to guess the zone.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Number of events to retrieve (default: 10, max: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds behavioral details beyond annotations: returns specific fields, default timezone, UTC authoritative datetime format. Annotations already indicate read-only, but description clarifies scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, each sentence adds value. Slightly long but necessary to cover return format and timezone behavior. Well-organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lists return fields and datetime format, but missing pagination details beyond page size (e.g., how to get next page). No output schema, so description covers most needed context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (count) with 100% schema coverage. Description repeats schema info (default, max) but does not add new semantic context beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Explicitly states it lists upcoming calendar events for the signed-in user and is read-only. Clearly distinguishes from siblings like create-event and read-email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says this tool does not filter and directs to alternatives (Outlook UI or Graph API) for filtered queries. Also explains count parameter for page size control.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mailbox-settingsAIdempotent
Read or update mailbox-level settings (idempotent — safe to retry; sets are PATCH-style and merge with existing state). action=get (default) returns settings — use section to filter (language, timeZone, workingHours, automaticRepliesSetting, or all). action=set-auto-replies configures out-of-office: enabled true/false, optional startDateTime/endDateTime (ISO 8601) for scheduled mode, internalReplyMessage and (optionally) externalReplyMessage. action=set-working-hours updates the schedule: startTime/endTime (HH:MM) and daysOfWeek (array of monday..sunday). Returns the updated settings object on set actions.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Action to perform (default: get) | |
| enabled | No | Enable (true) or disable (false) automatic replies (action=set-auto-replies) | |
| endTime | No | Work end time in HH:MM format, e.g. '17:00' (action=set-working-hours) | |
| section | No | Specific section to retrieve (action=get, default: all) | |
| timeZone | No | Time zone name, e.g. 'Australia/Melbourne' (action=set-working-hours) | |
| startTime | No | Work start time in HH:MM format, e.g. '09:00' (action=set-working-hours) | |
| daysOfWeek | No | Work days, e.g. ['monday','tuesday','wednesday','thursday','friday'] (action=set-working-hours) | |
| endDateTime | No | End date/time for scheduled mode, ISO 8601 format (action=set-auto-replies) | |
| startDateTime | No | Start date/time for scheduled mode, ISO 8601 format (action=set-auto-replies) | |
| externalAudience | No | Who receives external reply (action=set-auto-replies) | |
| externalReplyMessage | No | Reply message for external senders (action=set-auto-replies) | |
| internalReplyMessage | No | Reply message for internal senders (action=set-auto-replies) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses idempotency (safe to retry), PATCH-style merging with existing state, and return behavior for set actions. This goes beyond the annotations' idempotentHint and readOnlyHint, adding valuable context about how updates behave and what the agent can expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-organized, starting with the primary purpose and idempotency note, then breaking down each action with its relevant parameters. It is long but every sentence contributes useful information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 12 parameters, 3 actions, and no output schema, the description comprehensively covers retrieval with section filtering, configuration of auto-replies and working hours, and return behavior for set actions. It is sufficiently complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even with 100% schema coverage, the description adds significant value by mapping parameters to specific actions (e.g., startTime/endTime/daysOfWeek for set-working-hours, enabled/startDateTime/endDateTime for set-auto-replies) and clarifying defaults (action=get). This reduces ambiguity for parameter selection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads or updates mailbox-level settings, with specific sub-actions (get, set-auto-replies, set-working-hours). This distinguishes it from sibling tools like search-emails or list-events, which handle different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use each action (e.g., action=get to retrieve settings, action=set-auto-replies for out-of-office), but does not explicitly mention alternatives or when not to use this tool. It lacks explicit exclusions, but the tool's purpose is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage-categoryA
Manage the user's master category list (the colour-coded labels available across mail/calendar/contacts). action=list (default) returns categories with id/displayName/color. action=create adds a new category — displayName required, color optional (preset0-preset24, e.g. preset0=Red, preset7=Blue). action=update (alias set — deprecated) changes name/colour by id. action=delete removes a category — this does NOT untag messages already labelled with it; existing messages retain the orphaned label until manually cleaned. Use apply-category to tag/untag specific messages.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Category ID (action=update/delete, required) | |
| color | No | Color preset, e.g. preset0=Red, preset7=Blue (action=create/update) | |
| action | No | Action to perform (default: list). 'set' is a deprecated alias for 'update'. | |
| categoryId | No | DEPRECATED: alias for `id`. Will be removed in a future release. | |
| displayName | No | Category name (action=create required, action=update optional) | |
| outputVerbosity | No | Output detail level (action=list, default: standard) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that `delete` does not untag existing messages, provides color preset examples, and clarifies required/optional parameters per action. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Efficiently packed with information in a single paragraph, clearly separating actions with bullet-like clarity. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all actions and parameters, explains output for `list`, notes relationship to sibling tool, and includes deprecation warnings. Comprehensive given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds meaning beyond schema by describing action semantics, color mapping, parameter dependencies (e.g., `displayName` required for create), and deprecation of `categoryId`.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it manages the master category list (colour-coded labels) with specific actions (list, create, update, delete). It distinguishes from the sibling tool `apply-category` which handles tagging/untagging of messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly explains when to use each action, defaults to `list`, notes deprecated alias `set` for update, and points to `apply-category` for message-level operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage-contactADestructive
Full CRUD over the signed-in user's personal Outlook contacts (destructive: covers delete action). action=list (default) returns contacts with pagination via skip/count (default 50). action=search returns contacts matching query against name/email (default 25). action=get returns full contact detail by id. action=create adds a new contact and returns its id. action=update patches the given fields by id (only fields passed are changed). action=delete permanently removes the contact by id. Use outputVerbosity (minimal/standard/full) on list/search to control field count. Prefer search-people for cross-source relevance ranking (contacts + directory + recent comms) — this tool only searches your personal contact store.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Contact ID (action=get/update/delete, required) | |
| skip | No | Pagination offset for action=list (default: 0). Use the value suggested by the previous page response. | |
| count | No | Number of results (action=list default: 50, action=search default: 25) | |
| No | Primary email address (action=create/update) | ||
| notes | No | Personal notes (action=create/update) | |
| query | No | Search query for name or email (action=search, required) | |
| action | No | Action to perform (default: list) | |
| emails | No | Multiple email addresses (action=create/update). First entry is primary. | |
| folder | No | Contact folder ID (action=list) | |
| jobTitle | No | Job title (action=create/update) | |
| lastName | No | Surname (action=create/update). Maps to Graph `surname`. | |
| firstName | No | Given name (action=create/update). Maps to Graph `givenName`. If displayName not provided, will be combined with lastName. | |
| companyName | No | Company name (action=create/update) | |
| displayName | No | Full name (action=create/update) | |
| mobilePhone | No | Mobile phone number (action=create/update) | |
| outputVerbosity | No | Output detail level (action=list/search, default: standard) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description openly discloses destructive behavior ('destructive: covers `delete` action', 'permanently removes the contact') and patch semantics ('only fields passed are changed'). It also explains pagination behavior, default result counts, and output verbosity, adding substantial context beyond the annotations' destructiveHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-structured, covering all six actions in a logical order with defaults and side effects. Every sentence contributes needed information; there is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 16 parameters, no output schema, and a wide CRUD range, the description is remarkably complete. It covers action semantics, defaults, pagination, destructive behavior, and alternative tools, leaving virtually no ambiguity for an agent deciding to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for every parameter. The description adds action-specific meaning (which params apply to which action), clarifies defaults, and notes that the first email entry is primary and that displayName combines with lastName when not provided. This enriches the schema descriptions, though some grouping of params by action is only implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Full CRUD over the signed-in user's personal Outlook contacts'. It clearly defines the tool's scope and distinguishes it from the sibling 'search-people' tool by noting this tool only searches the personal contact store.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit action-by-action usage (list, search, get, create, update, delete) with defaults and parameter applicability. States when to prefer the alternative 'search-people' for cross-source relevance ranking, giving clear when-to-use vs. when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage-eventADestructive
Manage an existing calendar event (destructive: covers update/decline/cancel/delete — use dryRun where supported to preview). action=update edits fields in place via PATCH (subject, start, end, attendees, body, location, isOnlineMeeting, sensitivity, showAs, importance, categories, reminderMinutesBeforeStart) — only fields you pass are changed; pass dryRun: true to preview the PATCH payload. action=decline declines an invitation (optional comment). action=cancel cancels an event you organised and notifies attendees. action=delete permanently removes the event. Returns the updated event on update; status confirmation otherwise. Note: there is no accept action — accept invitations in the Outlook UI (Graph's accept verb is unreliable across personal/M365).
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Alias for `eventId` (canonical per the v3.7.3 alias pass). | |
| end | No | New end time as ISO 8601 string or {dateTime, timeZone} object (action=update only) | |
| body | No | New body content (action=update only) | |
| start | No | New start time as ISO 8601 string or {dateTime, timeZone} object (action=update only) | |
| action | Yes | Action to perform (required) | |
| dryRun | No | Preview the PATCH without applying it (action=update only). Returns the body that would be sent to Graph. | |
| showAs | No | Free/busy status shown to others (action=update only) | |
| comment | No | Optional comment for declining or cancelling the event | |
| eventId | No | The ID of the event | |
| subject | No | New subject (action=update only) | |
| location | No | New location display name (action=update only) | |
| attendees | No | Full replacement attendee list — pass complete desired list, or [] to clear (action=update only) | |
| categories | No | Full replacement category list — pass [] to clear (action=update only) | |
| importance | No | Event importance flag (action=update only) | |
| sensitivity | No | Event sensitivity classification (action=update only) | |
| isOnlineMeeting | No | Toggle online meeting flag (action=update only) | |
| reminderMinutesBeforeStart | No | Minutes before start to fire the reminder (action=update only) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Thoroughly discloses destructive behavior (cancel notifies attendees, delete permanently removes), PATCH semantics (only fields passed are changed), and dryRun side-effect-free preview. This adds significant value beyond the destructiveHint annotation and covers return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Despite being long, the description is well-organized by action, front-loaded with the destructive warning, and every sentence serves a purpose given the complex multi-action tool. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive: covers all actions, dryRun, accept limitation, return values, and PATCH merge behavior. With 17 params and no output schema, the description plus schema fully specify the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds critical semantics like 'only fields you pass are changed', 'full replacement list' for attendees/categories, and action-specific applicability. This enriches the schema-provided definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it manages existing calendar events (update/decline/cancel/delete) and differentiates from siblings like create-event and list-events. The four action types are enumerated, making the purpose specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use each action, including dryRun for previewing PATCH, and explicitly notes there is no accept action and instructs to use the Outlook UI instead. It lacks an explicit contrast with list-events/create-event but the scoping is evident.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage-focused-inboxA
Manage Focused Inbox sender overrides — explicit rules that force messages from a given sender into Focused or Other regardless of the ML classifier. action=list (default) returns existing overrides with id/sender/classifyAs. action=set creates or updates an override for emailAddress (optional name), routing future mail to focused (default) or other. action=delete removes the override for emailAddress. Note: this only works on accounts that have Focused Inbox enabled — personal Outlook.com accounts without it return an empty list.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Sender display name (action=set) | |
| action | No | Action to perform (default: list) | |
| classifyAs | No | Where to put emails from this sender (action=set, default: focused) | |
| emailAddress | No | Sender email address (action=set/delete, required) | |
| outputVerbosity | No | Output detail level (action=list, default: standard) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description contradicts the annotations. It explicitly includes action=delete which removes an override, yet annotations declare destructiveHint=false. This is a serious inconsistency that could mislead an agent about the tool's safety profile. Despite otherwise helpful behavioral details (e.g., list output, set creates or updates), the contradiction forces a low score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that front-loads the purpose, then cleanly explains each action and its parameters. The critical caveat is included without unnecessary fluff. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description covers the list return format and the account prerequisite. It misses explicit return values for set/delete, but overall it provides a clear behavioral model for the tool. This is nearly complete for a management tool with five parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value beyond the schema by explaining the list return format (id/sender/classifyAs), clarifies that set creates or updates, and notes the effect on future mail routing. These additions help the agent understand parameter usage in context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Focused Inbox sender overrides, explaining the exact mechanism (forcing messages into Focused or Other regardless of the ML classifier). It also enumerates specific actions (list/set/delete), distinguishing it from sibling tools like manage-rules or manage-category.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides strong usage context, including when each action should be used and a critical caveat that it only works on accounts with Focused Inbox enabled. It does not explicitly name alternative tools, but the domain is clearly scoped enough to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manage-rulesADestructive
Server-side inbox rule CRUD (destructive: covers delete; supports dryRun on create/update for preview). Rules run on the Exchange server regardless of which client is open. action=list (default) returns rules with id/name/sequence — pass includeDetails: true to expand conditions/actions/exceptions. action=create builds a new rule from condition params (12 supported: fromAddresses, containsSubject, bodyContains, hasAttachments, importance, sentTo, sensitivity, etc.), action params (9 supported: moveToFolder, forwardTo, redirectTo, assignCategories, markAsRead, delete, etc.), and optional except* exceptions. action=update patches the named fields by ruleId. action=reorder changes execution priority via sequence (lower = earlier). action=delete removes a rule. Recipient allowlist applies to forwardTo/redirectTo. permanentDelete action is intentionally omitted (too dangerous for AI use — use the Outlook UI). Subject to session rate limits (OUTLOOK_MAX_MANAGE_RULES_PER_SESSION).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Rule name (action=create required, action=update to rename) | |
| action | No | Action to perform (default: list) | |
| dryRun | No | Preview rule without creating/updating (action=create, action=update) | |
| ruleId | No | ID of existing rule (action=update/delete) | |
| ruleName | No | Name of existing rule (action=update/reorder/delete) | |
| sentCcMe | No | Match emails where I am in CC (action=create/update) | |
| sentToMe | No | Match emails sent to me (action=create/update) | |
| sequence | No | Execution order, lower = higher priority (action=create default: auto, action=reorder required) | |
| forwardTo | No | Comma-separated emails to forward matching messages to (action=create/update) | |
| isEnabled | No | Enable/disable rule (action=create default: true, action=update) | |
| importance | No | Match emails with this importance (action=create/update) | |
| markAsRead | No | Mark matching emails as read (action=create/update) | |
| redirectTo | No | Comma-separated emails to redirect matching messages to (action=create/update) | |
| displayName | No | Alias for `name` (matches Graph's own `displayName` field). | |
| sensitivity | No | Match emails with this sensitivity (action=create/update) | |
| bodyContains | No | Comma-separated body text keywords (OR logic) (action=create/update) | |
| copyToFolder | No | Folder name to copy matching emails to (action=create/update) | |
| moveToFolder | No | Folder name to move matching emails to (action=create/update) | |
| sentOnlyToMe | No | Match emails where I am the only recipient (action=create/update) | |
| deleteMessage | No | Move matching emails to Deleted Items (action=create/update) | |
| fromAddresses | No | Comma-separated sender emails to match (action=create/update) | |
| hasAttachments | No | Match emails with attachments (action=create/update) | |
| includeDetails | No | Include detailed conditions, actions, and exceptions (action=list) | |
| markImportance | No | Set importance on matching emails (action=create/update) | |
| senderContains | No | Comma-separated partial sender matches (action=create/update) | |
| containsSubject | No | Comma-separated subject keywords (OR logic). e.g. "invoice, receipt, payment" (action=create/update) | |
| sentToAddresses | No | Comma-separated recipient emails to match (action=create/update) | |
| assignCategories | No | Comma-separated Outlook categories to assign (action=create/update) | |
| isAutomaticReply | No | Match automatic reply emails (action=create/update) | |
| recipientContains | No | Comma-separated partial recipient matches (action=create/update) | |
| exceptBodyContains | No | Comma-separated body keywords to exclude (action=create/update) | |
| exceptFromAddresses | No | Comma-separated sender emails to exclude (action=create/update) | |
| stopProcessingRules | No | Stop evaluating subsequent rules (action=create/update) | |
| exceptHasAttachments | No | Exclude emails with attachments (action=create/update) | |
| exceptSenderContains | No | Comma-separated partial sender matches to exclude (action=create/update) | |
| bodyOrSubjectContains | No | Comma-separated keywords matching body OR subject (OR logic) (action=create/update) | |
| exceptSubjectContains | No | Comma-separated subject keywords to exclude (action=create/update) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool is destructive (covers delete) and that 'permanentDelete' is intentionally omitted for safety. It explains that rules run server-side regardless of client, supports dryRun for preview, and is subject to session rate limits. This adds significant value beyond the annotations (destructiveHint=true).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph covering many aspects. It is front-loaded with the main purpose but could benefit from bullet points or clearer separation of actions. However, given the tool's complexity with 37 parameters, it remains reasonably efficient without redundant sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 37 parameters, no output schema, and only basic annotations, the description covers all necessary context: all actions are explained, parameters are grouped logically, safe preview via dryRun is highlighted, dangerous operations are excluded, and rate limits are noted. It is fully adequate for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema already describes each parameter (100% coverage), the description groups condition parameters (12 supported), action parameters (9 supported), and exception parameters, and explains the logical OR for keyword searches. It clarifies the relationship between 'name' and 'displayName' and provides examples (e.g., 'invoice, receipt'). This adds meaningful semantic grouping.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Server-side inbox rule CRUD' and enumerates each action (list, create, update, reorder, delete), specifying that it covers destructive operations. It distinguishes itself from sibling tools like 'manage-focused-inbox' and 'apply-category' by focusing on inbox rules, and mentions intentional omission of permanentDelete as too dangerous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit context for each action: default action is list, dryRun for preview, reorder changes sequence, etc. It also warns about rate limits and the omission of permanentDelete. However, it does not explicitly compare to sibling tools or advise when to use this tool over others like 'manage-focused-inbox'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read-emailARead-only
Read a single email by id (read-only). Default: returns the full message body (HTML stripped to text by default), subject, from/to/cc, receivedDateTime, conversationId, attachments metadata, and webLink as Markdown. With headersMode: true: returns RFC-822 forensic headers instead (DKIM, SPF, DMARC, Received chain, Message-ID, Authentication-Results) — pair with importantOnly: true for the security-relevant subset, groupByType: true for category-bucketed view, or raw: true for JSON instead of Markdown. With includeHeaders: true (non-headers-mode): adds basic headers alongside body. Use outputVerbosity (minimal/standard/full) to control field count.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ID of the email to read | |
| raw | No | Return raw JSON instead of Markdown (headersMode only, default: false) | |
| groupByType | No | Group headers by category (headersMode only, default: false) | |
| headersMode | No | Return forensic headers instead of email content (default: false) | |
| importantOnly | No | Show only important headers (headersMode only, default: false) | |
| includeHeaders | No | Include basic headers alongside email content (default: false) | |
| outputVerbosity | No | Output detail level (default: standard) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description discloses return format (Markdown vs JSON), conditional headers (forensic vs basic), and output verbosity. Annotations already indicate read-only and open world; the description adds behavioral details on stripping HTML, attachment metadata, and mode combinations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single dense paragraph is well-structured: core action first, then defaults, then conditional modes. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, description sufficiently covers all modes, default returns, and formatting options. No gaps for typical usage scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 7 parameters (100% coverage). Description enriches semantics by explaining parameter interactions (e.g., headersMode with importantOnly, groupByType, raw) and default values for outputVerbosity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Read a single email by id (read-only)' with specific verb and resource. Default output and conditional modes are detailed, distinguishing it from sibling tools like send-email or draft.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description explains default behavior and various modes (headersMode, includeHeaders, outputVerbosity), providing clear context for different use cases. However, no explicit when-to-use or when-not-to-use compared to alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search-emailsARead-only
Search, list, delta-sync, or thread-group emails — six modes selected by parameters (read-only). With no params: lists recent emails in folder (default inbox). With query/from/to/subject/date filters: full search (combines via OData filter). With searchExpression (deprecated alias kqlQuery): a raw Microsoft Graph $search expression for advanced server-side search. With deltaMode: true: returns current state plus a deltaToken; pass the token back on the next call for incremental changes only — ideal for inbox monitoring. With groupByConversation: true: returns conversation threads. With conversationId: returns all messages in a single thread. With internetMessageId: looks up a message by its RFC Message-ID header. Personal Outlook.com accounts have limited $search support — this tool falls back through OData filters / boolean filters / recent listing automatically, but structured filters (from/subject/receivedAfter/hasAttachments/unreadOnly) return cleaner results. Returns paged messages with id/subject/from/receivedDateTime/preview by default; use outputVerbosity to expand.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Filter by recipient email/name | |
| from | No | Filter by sender email/name | |
| count | No | Number of results (list default: 25, search default: 10, max: 50) | |
| query | No | Search query text. Omit for list mode. | |
| folder | No | Email folder (default: 'inbox') | |
| subject | No | Filter by subject | |
| kqlQuery | No | DEPRECATED alias for `searchExpression` (this was never full KQL — it is a Graph `$search` expression). Prefer `searchExpression`. | |
| deltaMode | No | Enable delta sync mode. Returns only changes since last sync. Use deltaToken for subsequent calls. | |
| deltaToken | No | Token from previous delta call for incremental sync (deltaMode only) | |
| maxResults | No | Max results per page for delta sync (default: 100, max: 200) | |
| unreadOnly | No | Filter to unread emails only | |
| receivedAfter | No | Filter emails received after date (ISO 8601) | |
| conversationId | No | Get all messages in a conversation thread by conversationId. | |
| hasAttachments | No | Filter to emails with attachments | |
| includeHeaders | No | Include email headers for each message (conversationId only) | |
| receivedBefore | No | Filter emails received before date (ISO 8601) | |
| outputVerbosity | No | Output detail level (default: standard) | |
| searchAllFolders | No | Search across all mail folders | |
| searchExpression | No | Raw Microsoft Graph `$search` expression for advanced server-side search, e.g. `subject:"invoice"`, `from:github.com`, or `foo OR bar`. Quote your own phrases; a single bare token is auto-quoted. Pair with `searchAllFolders: true` for cross-folder search. Bypasses other search params. NOTE: on personal Outlook.com accounts field-scoped `$search` is best-effort and may return nothing — prefer `query` there (it has progressive fallback). | |
| internetMessageId | No | Look up email by Message-ID header (e.g. <abc123@example.com>). For threading/deduplication. | |
| groupByConversation | No | List conversations (threads) grouped by conversationId instead of individual emails. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses important behavioral nuances: automatic fallback through OData filters / boolean filters / recent listing on Outlook.com, deprecated alias behavior for kqlQuery, auto-quoting of search tokens, and the mechanics of delta tokens for incremental sync. This adds significant value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-organized, front-loading the core purpose and then systematically explaining each mode. It is long, but given 21 parameters and multiple modes, every sentence contributes necessary information without fluff. A tighter structure with bullet points could improve readability, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers return values ("Returns paged messages with id/subject/from/receivedDateTime/preview by default"), mode behavior, personal account limitations, and parameter interactions. With no output schema, this is sufficient context for an agent to select and invoke the tool correctly across all its modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema already covers all 21 parameters with descriptions, the tool description explains how parameters interact to select modes (e.g., deltaMode with deltaToken, searchExpression bypassing other params, groupByConversation vs conversationId). This cross-parameter semantic guidance goes beyond what the schema provides, though the baseline is 3 due to high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource statement: "Search, list, delta-sync, or thread-group emails — six modes selected by parameters (read-only)." It enumerates the distinct modes and explicitly notes the tool is read-only, which distinguishes it from sibling mutation tools like send-email and update-email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides detailed guidance on when to use each mode, such as "ideal for inbox monitoring" for delta mode and explicit fallback behavior on personal Outlook.com accounts. It does not explicitly contrast with direct alternatives like read-email for single-message lookup, but the mode distinctions and parameter guidance adequately convey usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search-peopleARead-only
Relevance-ranked search across personal contacts, organisation directory, and recent communications via the Microsoft Graph People API (read-only). Returns people objects with displayName, emailAddresses, companyName, jobTitle, and relevance metadata — ideal for "who is X?" or "who do I email about Y?" lookups. Use manage-contact action=search instead when you specifically need entries from your personal contact store only.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Maximum results to return (default: 25, max: 50) | |
| query | Yes | Search query (name, email, company) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and openWorldHint=true. The description adds that the tool uses Microsoft Graph People API, is read-only, and returns specific fields. No contradictions. It adds value beyond annotations but does not mention rate limits or pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. First sentence states core function, second sentence provides use cases and differentiation. Efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with no output schema, the description covers return fields, purpose, and differentiation. Annotations cover read-only and open-world aspects. Contextually complete given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters described. The description adds context that query can be 'name, email, company' and that count max is 50 (schema says max: 50). This enhances understanding beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Relevance-ranked search across personal contacts, organisation directory, and recent communications via the Microsoft Graph People API (read-only)' with specific return fields. It distinguishes from sibling tool 'manage-contact' with action='search'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states ideal use cases ('who is X?', 'who do I email about Y?') and provides an explicit alternative: 'Use manage-contact action=search instead when you specifically need entries from your personal contact store only.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send-emailADestructive
Compose and send an email immediately (destructive: sends external comms). Returns a confirmation with the saved-message id. Safety controls: dryRun: true returns the composed message for review without sending; checkRecipients: true runs get-mail-tips first to flag out-of-office / mailbox-full / delivery-restricted / external recipients; combine both for a full pre-send review. Subject to session rate limits (OUTLOOK_MAX_EMAILS_PER_SESSION env) and recipient allowlist (OUTLOOK_ALLOWED_RECIPIENTS env) when configured — calls outside the allowlist fail before any Graph request. For multi-step compose/review workflows prefer draft (action=create → update → send) since drafts can be inspected in Outlook before sending. Comma-separated recipient strings or arrays both accepted.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Comma-separated CC email addresses | |
| to | Yes | Comma-separated recipient email addresses | |
| bcc | No | Comma-separated BCC email addresses | |
| body | Yes | Email body (plain text or HTML) | |
| dryRun | No | Preview email without sending (default: false). Returns composed email for review. | |
| subject | Yes | Email subject | |
| importance | No | Email importance (default: normal) | |
| checkRecipients | No | Check recipients for out-of-office, mailbox full, delivery restrictions before sending (default: false). Combine with dryRun=true for pre-send review. | |
| saveToSentItems | No | Save to sent items (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint: true), description explains that it sends external comms, subject to rate limits and recipient allowlist, and that calls outside allowlist fail before Graph request. Provides detailed safety control behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single paragraph but well-structured with core purpose first. Contains multiple pieces of information but each is relevant. Could be slightly more concise, but overall effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters and no output schema, description covers safety, rate limits, allowlist, alternatives, parameter usage, and return value. Complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage, so baseline is 3. Description adds value by explaining interaction of dryRun and checkRecipients, accepting both string and array inputs, and describing return value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it composes and sends an email immediately, notes it is destructive, and returns confirmation with an id. It distinguishes from sibling 'draft' by specifying that for multi-step workflows draft is preferred.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (immediate send with safety controls) and when not to (prefer draft for multi-step compose/review). Mentions alternatives like 'get-mail-tips' and provides specific usage for dryRun and checkRecipients.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update-emailAIdempotent
Update message state without modifying content (idempotent — safe to retry). action=mark-read/mark-unread toggles the isRead flag on a single message by id. action=flag sets a follow-up flag with optional dueDateTime/startDateTime (ISO 8601). action=unflag clears the flag. action=complete marks the flag as done. Flag/unflag/complete accept either id (single) or ids (batch array) — batch operations use Graph $batch for efficiency. Returns status confirmation per message.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Single message ID (required for mark-read/mark-unread, or use instead of ids for flag actions) | |
| ids | No | Array of message IDs for batch flag/unflag/complete operations | |
| action | Yes | Action to perform (required) | |
| dueDateTime | No | Due date/time for follow-up, ISO 8601 (action=flag) | |
| startDateTime | No | Start date/time for follow-up, ISO 8601 (action=flag) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare idempotentHint=true, and description explicitly states 'idempotent — safe to retry', adding context. It details the effect of each action (toggles isRead, sets/clears flag, marks complete). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single paragraph of about 5 sentences, informative but could be more structured with bullet points or shorter sentences. However, no unnecessary information is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description mentions 'Returns status confirmation per message', which is sufficient. It covers all actions and parameters completely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant meaning beyond the input schema: it explains which actions use which parameters (e.g., dueDateTime only for flag, ids for batch flag/unflag/complete) and clarifies that id is required for mark-read/mark-unread. Schema coverage is 100% but description still adds value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it updates message state without modifying content. The verb 'Update' along with specific actions (mark-read, unflag, etc.) precisely indicates what the tool does. It distinguishes from sibling tools like 'read-email' or 'send-email'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description provides specific guidance on when to use each action and which parameters are required (e.g., id for mark-read/mark-unread, ids for batch flag operations). It mentions batch efficiency but lacks explicit when-not-to-use or references to alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
10 tool updates
v3.9.1- Added
apply-category - Added
auth - Added
find-meeting-rooms - Added
folders - Added
get-mail-tips - Added
mailbox-settings - Added
manage-contact - Added
manage-event - Added
manage-focused-inbox - Added
search-emails
12 tool updates
v3.9.0- Removed
apply-category - Changed
attachments1 field changed- changed
Input schema / properties / savePath / descriptionPrevious value: -"DEPRECATED alias for `outputDir`. Will be removed in v3.8.0."New value: +"DEPRECATED alias for `outputDir`. Will be removed in a future release."
- Removed
auth - Removed
find-meeting-rooms - Removed
folders - Removed
get-mail-tips - Removed
mailbox-settings - Changed
manage-category1 field changed- changed
Input schema / properties / categoryId / descriptionPrevious value: -"DEPRECATED: alias for `id`. Will be removed in v3.8.0."New value: +"DEPRECATED: alias for `id`. Will be removed in a future release."
- Removed
manage-contact - Removed
manage-event - Removed
manage-focused-inbox - Removed
search-emails
1 tool update
v3.8.0- Changed
manage-event14 fields changed- changed
Input schema / properties / action / enumPrevious value: -[ - "decline", - "cancel", - "delete" -]New value: +[ + "update", + "decline", + "cancel", + "delete" +] - added
Input schema / properties / attendeesAdded value: +{ + "description": "Full replacement attendee list — pass complete desired list, or [] to clear (action=update only)", + "items": { + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / bodyAdded value: +{ + "description": "New body content (action=update only)", + "type": "string" +} - added
Input schema / properties / categoriesAdded value: +{ + "description": "Full replacement category list — pass [] to clear (action=update only)", + "items": { + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / dryRunAdded value: +{ + "description": "Preview the PATCH without applying it (action=update only). Returns the body that would be sent to Graph.", + "type": "boolean" +} - added
Input schema / properties / endAdded value: +{ + "description": "New end time as ISO 8601 string or {dateTime, timeZone} object (action=update only)", + "oneOf": [ + { + "type": "string" + }, + { + "additionalProperties": false, + "properties": { + "dateTime": { + "type": "string" + }, + "timeZone": { + "type": "string" + } + }, + "required": [ + "dateTime" + ], + "type": "object" + } + ] +} - added
Input schema / properties / importanceAdded value: +{ + "description": "Event importance flag (action=update only)", + "enum": [ + "low", + "normal", + "high" + ], + "type": "string" +} - added
Input schema / properties / isOnlineMeetingAdded value: +{ + "description": "Toggle online meeting flag (action=update only)", + "type": "boolean" +} - added
Input schema / properties / locationAdded value: +{ + "description": "New location display name (action=update only)", + "type": "string" +} - added
Input schema / properties / reminderMinutesBeforeStartAdded value: +{ + "description": "Minutes before start to fire the reminder (action=update only)", + "type": "number" +} - added
Input schema / properties / sensitivityAdded value: +{ + "description": "Event sensitivity classification (action=update only)", + "enum": [ + "normal", + "personal", + "private", + "confidential" + ], + "type": "string" +} - added
Input schema / properties / showAsAdded value: +{ + "description": "Free/busy status shown to others (action=update only)", + "enum": [ + "free", + "tentative", + "busy", + "oof", + "workingElsewhere", + "unknown" + ], + "type": "string" +} - added
Input schema / properties / startAdded value: +{ + "description": "New start time as ISO 8601 string or {dateTime, timeZone} object (action=update only)", + "oneOf": [ + { + "type": "string" + }, + { + "additionalProperties": false, + "properties": { + "dateTime": { + "type": "string" + }, + "timeZone": { + "type": "string" + } + }, + "required": [ + "dateTime" + ], + "type": "object" + } + ] +} - added
Input schema / properties / subjectAdded value: +{ + "description": "New subject (action=update only)", + "type": "string" +}
22 tool updates
v3.7.4- Changed
access-shared-mailbox3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / emailAdded value: +{ + "description": "Alias for `sharedMailbox` (more intuitive name for the same value).", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "sharedMailbox" -]New value: +[]
- Changed
apply-category1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
attachments3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / outputDirAdded value: +{ + "description": "Directory to save file (action=download, default: system tmpdir). Auto-created if missing.", + "type": "string" +} - changed
Input schema / properties / savePath / descriptionPrevious value: -"Directory to save file (action=download, default: current directory)"New value: +"DEPRECATED alias for `outputDir`. Will be removed in v3.8.0."
- Changed
auth3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - changed
Input schema / properties / action / enumPrevious value: -[ - "status", - "authenticate", - "about" -]New value: +[ + "status", + "authenticate", + "device-code-complete", + "about" +] - added
Input schema / properties / methodAdded value: +{ + "description": "Auth method for action=authenticate. device-code (default): no auth server needed, works remotely. browser: traditional OAuth redirect via port 3333.", + "enum": [ + "device-code", + "browser" + ], + "type": "string" +}
- Changed
create-event1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Added
draft - Changed
export3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - changed
Input schema / properties / format / descriptionPrevious value: -"Export format (target=message: mime/eml/markdown/json/csv, target=conversation: eml/mbox/markdown/json/html/csv)"New value: +"Export format. Valid values vary by target: target=message accepts mime/eml/markdown/json/csv (mbox and html are conversation-only). target=conversation accepts eml/mbox/markdown/json/html/csv. target=messages (batch) accepts markdown/json/csv. mime is an alias for eml (same RFC822 bytes, .eml extension on disk)." - added
Input schema / properties / queryAdded value: +{ + "description": "Free-text search shortcut (target=messages). Equivalent to passing searchQuery: { subject: <query> }. Convenience alias for callers used to search-emails.", + "type": "string" +}
- Changed
find-meeting-rooms1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
folders1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Added
get-mail-tips - Changed
list-events1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
mailbox-settings1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
manage-category4 fields changed- added
Input schema / additionalPropertiesAdded value: +false - changed
Input schema / properties / action / descriptionPrevious value: -"Action to perform (default: list)"New value: +"Action to perform (default: list). 'set' is a deprecated alias for 'update'." - changed
Input schema / properties / action / enumPrevious value: -[ - "list", - "create", - "update", - "delete" -]New value: +[ + "list", + "create", + "update", + "set", + "delete" +] - added
Input schema / properties / categoryIdAdded value: +{ + "description": "DEPRECATED: alias for `id`. Will be removed in v3.8.0.", + "type": "string" +}
- Changed
manage-contact5 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / emailsAdded value: +{ + "description": "Multiple email addresses (action=create/update). First entry is primary.", + "items": { + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / firstNameAdded value: +{ + "description": "Given name (action=create/update). Maps to Graph `givenName`. If displayName not provided, will be combined with lastName.", + "type": "string" +} - added
Input schema / properties / lastNameAdded value: +{ + "description": "Surname (action=create/update). Maps to Graph `surname`.", + "type": "string" +} - added
Input schema / properties / skipAdded value: +{ + "description": "Pagination offset for action=list (default: 0). Use the value suggested by the previous page response.", + "type": "integer" +}
- Changed
manage-event3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / idAdded value: +{ + "description": "Alias for `eventId` (canonical per the v3.7.3 alias pass).", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "action", - "eventId" -]New value: +[ + "action" +]
- Changed
manage-focused-inbox1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
manage-rules38 fields changed- added
Input schema / additionalPropertiesAdded value: +false - changed
Input schema / properties / action / enumPrevious value: -[ - "list", - "create", - "reorder", - "delete" -]New value: +[ + "list", + "create", + "update", + "reorder", + "delete" +] - added
Input schema / properties / assignCategoriesAdded value: +{ + "description": "Comma-separated Outlook categories to assign (action=create/update)", + "type": "string" +} - added
Input schema / properties / bodyContainsAdded value: +{ + "description": "Comma-separated body text keywords (OR logic) (action=create/update)", + "type": "string" +} - added
Input schema / properties / bodyOrSubjectContainsAdded value: +{ + "description": "Comma-separated keywords matching body OR subject (OR logic) (action=create/update)", + "type": "string" +} - changed
Input schema / properties / containsSubject / descriptionPrevious value: -"Subject text the email must contain (action=create)"New value: +"Comma-separated subject keywords (OR logic). e.g. \"invoice, receipt, payment\" (action=create/update)" - added
Input schema / properties / copyToFolderAdded value: +{ + "description": "Folder name to copy matching emails to (action=create/update)", + "type": "string" +} - added
Input schema / properties / deleteMessageAdded value: +{ + "description": "Move matching emails to Deleted Items (action=create/update)", + "type": "boolean" +} - added
Input schema / properties / displayNameAdded value: +{ + "description": "Alias for `name` (matches Graph's own `displayName` field).", + "type": "string" +} - added
Input schema / properties / dryRunAdded value: +{ + "description": "Preview rule without creating/updating (action=create, action=update)", + "type": "boolean" +} - added
Input schema / properties / exceptBodyContainsAdded value: +{ + "description": "Comma-separated body keywords to exclude (action=create/update)", + "type": "string" +} - added
Input schema / properties / exceptFromAddressesAdded value: +{ + "description": "Comma-separated sender emails to exclude (action=create/update)", + "type": "string" +} - added
Input schema / properties / exceptHasAttachmentsAdded value: +{ + "description": "Exclude emails with attachments (action=create/update)", + "type": "boolean" +} - added
Input schema / properties / exceptSenderContainsAdded value: +{ + "description": "Comma-separated partial sender matches to exclude (action=create/update)", + "type": "string" +} - added
Input schema / properties / exceptSubjectContainsAdded value: +{ + "description": "Comma-separated subject keywords to exclude (action=create/update)", + "type": "string" +} - added
Input schema / properties / forwardToAdded value: +{ + "description": "Comma-separated emails to forward matching messages to (action=create/update)", + "type": "string" +} - changed
Input schema / properties / fromAddresses / descriptionPrevious value: -"Comma-separated sender email addresses (action=create)"New value: +"Comma-separated sender emails to match (action=create/update)" - changed
Input schema / properties / hasAttachments / descriptionPrevious value: -"Apply to emails with attachments (action=create)"New value: +"Match emails with attachments (action=create/update)" - added
Input schema / properties / importanceAdded value: +{ + "description": "Match emails with this importance (action=create/update)", + "enum": [ + "low", + "normal", + "high" + ], + "type": "string" +} - changed
Input schema / properties / includeDetails / descriptionPrevious value: -"Include detailed rule conditions and actions (action=list)"New value: +"Include detailed conditions, actions, and exceptions (action=list)" - added
Input schema / properties / isAutomaticReplyAdded value: +{ + "description": "Match automatic reply emails (action=create/update)", + "type": "boolean" +} - changed
Input schema / properties / isEnabled / descriptionPrevious value: -"Enable rule after creation, default: true (action=create)"New value: +"Enable/disable rule (action=create default: true, action=update)" - changed
Input schema / properties / markAsRead / descriptionPrevious value: -"Mark matching emails as read (action=create)"New value: +"Mark matching emails as read (action=create/update)" - added
Input schema / properties / markImportanceAdded value: +{ + "description": "Set importance on matching emails (action=create/update)", + "enum": [ + "low", + "normal", + "high" + ], + "type": "string" +} - changed
Input schema / properties / moveToFolder / descriptionPrevious value: -"Folder to move matching emails to (action=create)"New value: +"Folder name to move matching emails to (action=create/update)" - changed
Input schema / properties / name / descriptionPrevious value: -"Name of the rule to create (action=create, required)"New value: +"Rule name (action=create required, action=update to rename)" - added
Input schema / properties / recipientContainsAdded value: +{ + "description": "Comma-separated partial recipient matches (action=create/update)", + "type": "string" +} - added
Input schema / properties / redirectToAdded value: +{ + "description": "Comma-separated emails to redirect matching messages to (action=create/update)", + "type": "string" +} - changed
Input schema / properties / ruleId / descriptionPrevious value: -"ID of the rule to delete (action=delete)"New value: +"ID of existing rule (action=update/delete)" - changed
Input schema / properties / ruleName / descriptionPrevious value: -"Name of the rule (action=reorder required, action=delete alternative to ruleId)"New value: +"Name of existing rule (action=update/reorder/delete)" - added
Input schema / properties / senderContainsAdded value: +{ + "description": "Comma-separated partial sender matches (action=create/update)", + "type": "string" +} - added
Input schema / properties / sensitivityAdded value: +{ + "description": "Match emails with this sensitivity (action=create/update)", + "enum": [ + "normal", + "personal", + "private", + "confidential" + ], + "type": "string" +} - added
Input schema / properties / sentCcMeAdded value: +{ + "description": "Match emails where I am in CC (action=create/update)", + "type": "boolean" +} - added
Input schema / properties / sentOnlyToMeAdded value: +{ + "description": "Match emails where I am the only recipient (action=create/update)", + "type": "boolean" +} - added
Input schema / properties / sentToAddressesAdded value: +{ + "description": "Comma-separated recipient emails to match (action=create/update)", + "type": "string" +} - added
Input schema / properties / sentToMeAdded value: +{ + "description": "Match emails sent to me (action=create/update)", + "type": "boolean" +} - changed
Input schema / properties / sequence / descriptionPrevious value: -"Execution order, lower numbers run first (action=create default: 100, action=reorder required)"New value: +"Execution order, lower = higher priority (action=create default: auto, action=reorder required)" - added
Input schema / properties / stopProcessingRulesAdded value: +{ + "description": "Stop evaluating subsequent rules (action=create/update)", + "type": "boolean" +}
- Changed
read-email1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
search-emails1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
search-people1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
send-email2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / checkRecipientsAdded value: +{ + "description": "Check recipients for out-of-office, mailbox full, delivery restrictions before sending (default: false). Combine with dryRun=true for pre-send review.", + "type": "boolean" +}
- Changed
update-email1 field changed- added
Input schema / additionalPropertiesAdded value: +false
20 tool updates
v3.4.1- First observed
access-shared-mailbox - First observed
apply-category - First observed
attachments - First observed
auth - First observed
create-event - First observed
export - First observed
find-meeting-rooms - First observed
folders - First observed
list-events - First observed
mailbox-settings - First observed
manage-category - First observed
manage-contact - First observed
manage-event - First observed
manage-focused-inbox - First observed
manage-rules - First observed
read-email - First observed
search-emails - First observed
search-people - First observed
send-email - First observed
update-email
TDQS
Each tool targets a distinct aspect of Outlook (auth, mail, calendar, contacts, settings, etc.) with clear boundaries. Even similar operations like 'search-emails' and 'read-email' or 'send-email' and 'draft' have well-defined differences in purpose and usage.
Most tool names follow a consistent verb_noun pattern (e.g., search-emails, send-email). A few outliers like 'auth', 'attachments', and 'draft' break the pattern but are still intuitive and recognizable.
With 22 tools, the server covers a broad yet focused set of Outlook capabilities without being overwhelming. Each tool serves a clear purpose, and the count aligns well with the server's scope.
The tool set covers major Outlook workflows (mail, calendar, contacts, settings, rules) but has minor gaps like lacking a calendar list tool beyond the default calendar and no support for contact groups or distribution lists.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Manage Microsoft 365 email, calendar, contacts and inbox rules via the Graph API with OAuth 2.0.
Hosted MCP server with managed OAuth for 15+ toolkits: Google Workspace, Fitbit, Oura, Kalshi, etc.
Remote MCP server: 19 domain-hygiene and email-auth tools (DNS, SPF, DMARC, DKIM, TLS).
MCP server for Nylas — read email, calendars, events and contacts, and send email or create events.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA modular collection of MCP servers for automating virtual secretary tasks within Microsoft Outlook, including email management, calendar operations, contacts, tasks, and mailbox settings through Microsoft Graph API.5MIT
- AlicenseAqualityAmaintenanceMCP server that provides 62 tools to manage Outlook mail, calendar, contacts, and tasks for personal Microsoft accounts via Microsoft Graph API.6222MIT
- FlicenseNot gradedqualityCmaintenanceEnables to manage your Outlook mailbox via Microsoft Graph (write access) with delegated permissions, providing MCP tools to create, modify, and send emails, folders, categories, rules, and automatic replies.-
- AlicenseAqualityCmaintenanceProduction-grade MCP server for Microsoft 365, providing tools to manage Email, Calendar, Contacts, OneDrive, Teams, Tasks, and Users via delegated OAuth.44601MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/littlebearapps/outlook-assistant'
If you have feedback or need assistance with the MCP directory API, please join our Discord server