email-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@email-mcpshow my unread emails from the last week"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
email-mcp
Local MCP server for multi-account IMAP/SMTP email (iCloud + Gmail via app-specific passwords). Never marks mail read. Cross-folder search, idempotent sends, TLS verified.
Two surfaces share the same core:
stdio MCP server (this README) — single user, runs per-client, config from an accounts file + Keychain/env.
HTTP service (
pip install "email-mcp[http]",email-mcp-http) — long-lived and multi-tenant: MCP over streamable-HTTP behind scoped per-agent keys, a web dashboard, Matrix-bot onboarding, and owner-approved sends (👍 OTP) for recipients outside the allowlist. Guide: src/email_mcp/http/HELP.md — also served live by the service atGET /help(JSON summary atGET /info).
Status
Tested against iCloud only. The design is provider-generic (Gmail config is included as an example), but only iCloud has been exercised end-to-end so far. Gmail/others are untested — use at your own risk and please report back.
macOS only (uses the macOS Keychain via
keyring).
Related MCP server: email-mcp
Requirements
An app-specific password for each mailbox, stored in your macOS Keychain (see Configure / Get an app-specific password). The password is read from the Keychain at runtime — it is never written to disk, logged, or returned by any tool.
You must grant Keychain permission. The first time the server reads the password, macOS shows a dialog: "… wants to use your confidential information stored in 'email-mcp' in your keychain." — click Allow (or Always Allow). This grants access to only that one
email-mcpitem, nothing else in your Keychain. Note the prompt is tied to the specific Python binary running the server, so it may re-ask if you switch interpreters.
Install
pip install email-mcp # or: pipx install email-mcpThis provides an email-mcp command (and python -m email_mcp.server).
Configure
Create your account registry at
~/.config/email-mcp/accounts.yml(seeconfig/accounts.example.ymlfor the format). Override the location with theEMAIL_MCP_ACCOUNTSenv var if you prefer.Store each account's app-specific password in the macOS Keychain:
python -m email_mcp.setup_cli icloud-personal(For local development you can instead set
EMAIL_MCP_PASSWORDin a.env.)
Register with Claude Code
claude mcp add email --scope user -- email-mcpTools
list_accounts, set_default_account, list_folders, get_emails (recency by default;
search via query/filters; per-message attachments metadata), download_attachment,
send_email (idempotent; optional attachments), mark_email, move_email.
Security policy
Optional security: section in the accounts file (all patterns are case-insensitive
full-match regexes; plain values work as-is — see config/accounts.example.yml):
allowed_recipients— when set, everysend_emailrecipient must match one or the send isBLOCKED (recipient_not_allowed)before SMTP and before the dedup ledger. Unset = allow all; an explicitly empty list blocks all sends. Each recipient is first canonicalized to its bare address(es) with the same parser SMTP uses, so a single entry bundling extra addresses behind a comma or display name ("ok@x.com, other@y.com") is checked address-by-address — and that same canonical set is what reaches SMTP and the dedup ledger.Trash is protected by default — the reserved trash names of the major providers (
Trash,Binfor Gmail UK,Deleted Messagesfor iCloud,Deleted Itemsfor Outlook, subfolders included) are read-only: nothing can be moved into or out of them and messages there can't be flagged or expunged. Since moving-to-trash is the only delete this server has, the MCP cannot delete mail at all under the default policy. Opt out withprotect_trash: false(applies on the next call). Note: a bareDeleted(some Exchange/O365/Dovecot setups) is not auto-matched — add it toprotected_folders.protected_folders— additional read-only folders (same semantics as trash).readable_folders/blocked_folders— gate reading (get_emails,download_attachment, folder listing, and the folder sets searched for mutations). A blocked folder is also refused as amove_emaildestination. Whenreadable_foldersis set only matching folders are readable;blocked_foldersalways wins. Blocked folders are also omitted fromlist_folders. Policy violations return structured results (folder_protected,folder_blocked,folders_blocked,recipient_not_allowed) — never exceptions. Config is re-read per call, so edits apply without restarting the server.
Searching & speed
get_emailshas two modes, reported bysearched_window_onlyin the result:No search terms → fast: the most-recent
page*page_sizeper folder, served from an in-memory cache when warm (a repeat read is ~instant).searched_window_only=truehere, so an empty result means "not in the recent window", not "doesn't exist". Passfresh=trueto force a live read.Search (
query,from_address,subject,since=YYYY-MM-DD,has_attachment, or rawfilters.criteria) → runs server-side over the whole mailbox —queryis a full-text IMAP search, so matches outside the recent window are found.searched_window_only=false.
body=falseomits message bodies (cheap headers + attachment metadata) — ideal for finding a message before opening it. Each message also carriesuid/uidvalidityfor robust follow-up actions.Background prefetch keeps the latest INBOX warm. Off by default; enable with
EMAIL_MCP_PREFETCH_INTERVAL=120(seconds; delta-fetches only new mail by UID, never marks read). Cache size knobs:EMAIL_MCP_CACHE_ENTRIES(256),EMAIL_MCP_CACHE_BYTES(32MiB),EMAIL_MCP_CACHE_BODY_MAX(64KiB),EMAIL_MCP_CACHE_RECENT_TTL(180s).send_emaildedup: by default a 2nd mail to the same recipients within 10 min is BLOCKED.allow_duplicate=truerelaxes this to block only a true repeat (same recipients AND subject/body);idempotency_keygives caller-controlled dedup.
Roadmap: running this as one shared HTTP server so a whole fleet of agents share a single warm cache + prefetch — see
docs/TODO-http-shared-server.md.
Attachments
Reading:
get_emailsreports anattachmentslist per message ({index, filename, mime_type, size, inline}) — metadata only, never the bytes.download_attachment(message_id, filename=… | index=…)writes one attachment to disk (read-only; never marks mail read) and returns the saved path.download_all=truesaves every attachment;return_base64=truereturns small files (≤256KB) inline instead of to disk;uid+folder(from get_emails) locate a message with no/duplicate Message-ID. Files land inEMAIL_MCP_DOWNLOAD_DIR(default~/.local/state/email-mcp/attachments) unless you passdest_dir. The email-supplied filename is sanitized and confined to that directory (path-traversal safe); existing files are not clobbered unlessoverwrite=true.Sending:
send_email's optionalattachmentsis a list where each item is either{"path": "/local/file"}(read from disk) or{"content": "<base64>", "filename": "name.ext"}, with an optional"mime_type". Combined size is capped at 25 MB.
Get an app-specific password
iCloud: appleid.apple.com -> Sign-In & Security -> App-Specific Passwords.
Gmail: myaccount.google.com -> Security -> App passwords.
Develop
python3.12 -m venv .venv && .venv/bin/pip install -e ".[dev]"
.venv/bin/pytestAvailable Tools
8 toolsdownload_attachmentA
Download a message's attachment(s) — read-only, never marks mail read.
Select one by filename or index (from get_emails' attachments list); a lone
attachment needs neither; download_all=true saves every attachment. Saved into the
server download dir (override env EMAIL_MCP_DOWNLOAD_DIR) unless dest_dir is given;
the email-supplied filename is sanitized and confined to that directory.
return_base64=true returns the bytes inline (small files only, ≤256KB) instead of
writing to disk. uid+folder (from get_emails) locate the message directly — use
them when a message has no/duplicate Message-ID. Returns {saved_path|content_base64,
filename, mime_type, size, ...}.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes | ||
| filename | No | ||
| index | No | ||
| dest_dir | No | ||
| account | No | ||
| folders | No | ||
| overwrite | No | ||
| download_all | No | ||
| return_base64 | No | ||
| uid | No | ||
| folder | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully bears the burden. It discloses read-only behavior, download methods, base64 limit, file sanitization, and output format, providing comprehensive behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise yet thorough, front-loading the main purpose and using efficient language. Every sentence adds value without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains return values well and covers edge cases (uid/folder) and limitations (base64 size). Missing details on a few schema parameters reduce completeness slightly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must explain parameters. It covers most key parameters (filename, index, dest_dir, download_all, return_base64, uid, folder) but omits 'account', 'folders', and 'overwrite', leaving some gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool downloads a message's attachment(s) and declares it as read-only. It distinguishes itself from sibling tools like get_emails and send_email by specifying its function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on how to select attachments (by filename, index, or lone attachment) and when to use uid/folder. It lacks explicit when-not-to-use instructions but covers key usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailsA
Fetch or search emails. Never marks mail read. Defaults to INBOX + Junk.
Two modes, reported by searched_window_only in the result:
No search terms: fast — the most-recent page*page_size per folder, served from an in-memory cache when warm.
searched_window_only=truehere, so an empty result means 'not in the recent window', not 'doesn't exist'.fresh=trueforces a live read past the cache.Search (
query,from_address,subject,since=YYYY-MM-DD,has_attachment, or rawfilters.criteria): runs SERVER-SIDE over the whole mailbox —queryis a full-text IMAP search, so matches outside the recent window are found.searched_window_only=false.
body=false omits message bodies (cheap headers + attachment metadata — ideal for
finding a message before opening it). cached=true keeps the 60-min result-set
cache for stable pagination. Each message includes uid/uidvalidity for robust
follow-up actions.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | ||
| filters | No | ||
| query | No | ||
| folders | No | ||
| include_sent | No | ||
| strip_to_text | No | ||
| page | No | ||
| page_size | No | ||
| cached | No | ||
| body | No | ||
| from_address | No | ||
| subject | No | ||
| since | No | ||
| has_attachment | No | ||
| fresh | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses key behaviors: never marks mail read, defaults to INBOX+Junk, caching behavior, modes, and result markers like searched_window_only and uid/uidvalidity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear summary and bulleted modes. It is slightly long but every sentence adds value; could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (15 params, no output schema), the description covers modes, caching, pagination, and result fields. Missing details on account selection and attachment handling beyond has_attachment, but overall quite complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given 0% schema coverage, the description explains many parameters (body, cached, fresh, query, from_address, subject, since, has_attachment, filters.criteria) and the two modes. However, parameters like account, folders, include_sent, strip_to_text, page, page_size are not fully described, though page/page_size are implied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch or search emails' and distinguishes two modes (fast recent vs. full server-side search), which differentiates it from sibling tools like mark_email or send_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use each mode and the role of cached vs. fresh results. It does not explicitly mention when not to use this tool or alternatives, but the sibling context and tool names provide adequate guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsA
List accounts and which is the default.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It only states it lists accounts and the default, with no mention of authentication, rate limits, or behavior when no accounts exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with no unnecessary words. Every sentence contributes information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter tool without output schema, the description is mostly adequate. It tells the agent what it returns (list of accounts and default), though more detail on output format or ordering could help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds meaning by specifying that it also shows the default account, which is beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'accounts', and adds that it identifies the default account. This distinguishes it from siblings like 'set_default_account' and other email-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, such as 'get_emails' or 'set_default_account'. The description does not specify prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersB
List mail folders (folders the security policy blocks from reading are omitted).
| Name | Required | Description | Default |
|---|---|---|---|
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It only discloses that folders blocked by security policy are omitted, but says nothing about authentication, rate limits, or behavior when the optional account parameter is omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the key action. While it is not wasteful, it could benefit from a slightly more structured format to include parameter info.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 optional parameter, no output schema), the description provides the basic purpose and a behavioral caveat. However, it lacks detail on the return format and the exact role of the account parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 1 parameter ('account') with 0% description coverage and no enum. The tool description does not explain the meaning or usage of 'account', leaving its semantics ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List mail folders' with a specific verb and resource, and adds a meaningful qualifier about security policy filtering, distinguishing it from siblings like get_emails or list_accounts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus its siblings (e.g., list_accounts, get_emails). There is no mention of prerequisites or excluded scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_emailA
Mark a message read or unread. Refused (folder_protected) for messages in a protected folder — Trash/Bin/Deleted * by default, plus security.protected_folders.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes | ||
| read | Yes | ||
| account | No | ||
| folders | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that the tool may be refused for protected folders, which is a key behavioral trait. However, it does not mention other side effects like notifications or permanence.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, concise and front-loaded with the core purpose. No superfluous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no output schema, and 0% schema description coverage, the tool definition is incomplete. It fails to explain the role of the 'account' and 'folders' parameters, leaving important usage aspects unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, yet the description does not explain the four parameters (message_id and read are self-explanatory, but account and folders are ambiguous). The description should provide more detail on optional parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool marks a message read or unread, using a specific verb and resource. It distinguishes from siblings like move_email and send_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions that the tool is refused for messages in protected folders (Trash/Bin/Deleted, plus security.protected_folders), providing a clear when-not-to-use condition. However, it does not explicitly state when to use this tool over alternatives like move_email.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emailB
Move a message to another folder. Protected folders (Trash/Bin/Deleted * by default, plus security.protected_folders) are read-only: nothing can be moved into or out of them — i.e. with the default policy this server cannot delete mail.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes | ||
| dest_folder | Yes | ||
| account | No | ||
| folders | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It explains the constraint about protected folders, which is a key behavioral trait. However, it does not mention side effects (e.g., deletion from source), authorization needs, or reversibility, leaving gaps for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with front-loaded purpose and a critical constraint. No wasted words, though it could be restructured to include parameter hints without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is brief for a tool with 4 parameters, no output schema, and no annotations. It lacks details on return values, error handling, and what happens to the original message, making it incomplete for an agent to use reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the four parameters (message_id, dest_folder, account, folders). It only provides high-level purpose, failing to clarify required inputs or their formatting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Move a message to another folder,' providing a specific verb and resource. It adds context about protected folders, which distinguishes its functionality from sibling tools like mark_email or get_emails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating protected folders are read-only, but it does not explicitly guide when to use this tool versus alternatives (e.g., mark_email). No mention of prerequisites or scenarios where this tool is preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailA
Send an email. Idempotent: by default a second mail to the same recipients
within 10 minutes is BLOCKED, not resent. allow_duplicate=true relaxes this to
block only a true repeat (same recipients AND subject/body), so distinct messages
to the same person go through. idempotency_key overrides entirely: blocks iff that
key was used in the window (caller-controlled dedup).
attachments is an optional list; each item is either {"path": "/local/file"}
(read from disk) or {"content": "", "filename": "name.ext"}, with an
optional "mime_type". Combined size must stay under 25MB. Note: a {"path"} item
reads any file this process can access and emails it — only attach paths you
intend to send; never a path derived from untrusted/email-supplied content.
If security.allowed_recipients is configured, every recipient must match it or
the send is BLOCKED with reason=recipient_not_allowed.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| subject | Yes | ||
| body | Yes | ||
| account | No | ||
| tags | No | ||
| attachments | No | ||
| allow_duplicate | No | ||
| idempotency_key | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavioral traits: idempotency (duplicate blocking, allow_duplicate, idempotency_key), attachment constraints (size, type, security warning), and recipient restriction. This is exceptionally informative.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively long but each sentence adds value, covering essential behaviors. It starts with the core purpose and then adds details in a logical order. Could be slightly more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given complexity (idempotency, attachments, security) and no output schema, the description covers most aspects. However, it omits expected response format and some parameter details (e.g., account, tags), leaving small gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description covers allow_duplicate, idempotency_key, and attachments in detail, but does not explain 'to', 'subject', 'body', 'account', or 'tags' beyond schema types. Schema coverage is 0%, so description must compensate; it does partially but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Send an email', specifying the verb and resource. Among sibling tools like download_attachment and get_emails, this tool's function is distinct and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Usage is implied by the tool's purpose, but the description lacks differentiation from other email tools or conditions for choosing this one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_default_accountB
Set the default account (used when account is omitted).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It fails to disclose important behavioral traits such as persistence, scope, or side effects of setting a default account.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise at one sentence, and gets straight to the point. However, it sacrifices some completeness for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, no output schema), the description is minimally adequate but lacks context on default account semantics, such as whether the setting is persistent or per-session.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description should explain the 'name' parameter beyond its name. It only says 'name' without specifying what it refers to (e.g., account name).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Set the default account' and explains its use case when 'account' is omitted. It distinguishes from sibling tools like list_accounts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a hint about when to use it ('when `account` is omitted'), but does not provide explicit guidance on when not to use it or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v0.1.1- First observed
download_attachment - First observed
get_emails - First observed
list_accounts - First observed
list_folders - First observed
mark_email - First observed
move_email - First observed
send_email - First observed
set_default_account
TDQS
Each tool targets a distinct operation (downloading attachments, fetching emails, listing accounts/folders, marking/moving/sending emails, setting default account). There is no overlap or ambiguity.
All tool names follow a consistent verb_noun pattern with snake_case (e.g., download_attachment, get_emails, list_folders). No mixing of conventions.
With 8 tools, the server covers core email operations without being too sparse or overly heavy. Each tool serves a clear purpose.
Covers essential email operations (send, receive, list, mark, move, attachments) but lacks a direct delete capability; the move_email tool cannot move to protected folders like Trash, limiting deletion.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
MCP server for Nylas — read email, calendars, events and contacts, and send email or create events.
Read, search, send, organize, draft and schedule email across your inboxes from any MCP client.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceA minimal MCP server for reading and sending emails via IMAP/SMTP, supporting multiple accounts in a single instance with zero external dependencies.1-
- FlicenseNot gradedqualityCmaintenanceLocal IMAP/SMTP MCP server that lets Claude read, search, draft, send, flag, and move mail across multiple IMAP mailboxes. Credentials stay on your machine.-
- AlicenseAqualityCmaintenancePrivacy-first local MCP server for personal @163.com mailboxes, connecting via IMAP/SMTP with read-only search and write operations guarded by confirmation tokens.12MIT
- AlicenseNot gradedqualityCmaintenanceA minimal MCP server for reading, searching, managing, and sending email over IMAP and SMTP.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/swapnilsurdi/email_mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server