Skip to main content
Glama
swapnilsurdi

email-mcp

by swapnilsurdi

email-mcp

Local MCP server for multi-account IMAP/SMTP email (iCloud + Gmail via app-specific passwords). Never marks mail read. Cross-folder search, idempotent sends, TLS verified.

Two surfaces share the same core:

  • stdio MCP server (this README) — single user, runs per-client, config from an accounts file + Keychain/env.

  • HTTP service (pip install "email-mcp[http]", email-mcp-http) — long-lived and multi-tenant: MCP over streamable-HTTP behind scoped per-agent keys, a web dashboard, Matrix-bot onboarding, and owner-approved sends (👍 OTP) for recipients outside the allowlist. Guide: src/email_mcp/http/HELP.md — also served live by the service at GET /help (JSON summary at GET /info).

Status

  • Tested against iCloud only. The design is provider-generic (Gmail config is included as an example), but only iCloud has been exercised end-to-end so far. Gmail/others are untested — use at your own risk and please report back.

  • macOS only (uses the macOS Keychain via keyring).

Related MCP server: email-mcp

Requirements

  • An app-specific password for each mailbox, stored in your macOS Keychain (see Configure / Get an app-specific password). The password is read from the Keychain at runtime — it is never written to disk, logged, or returned by any tool.

  • You must grant Keychain permission. The first time the server reads the password, macOS shows a dialog: "… wants to use your confidential information stored in 'email-mcp' in your keychain." — click Allow (or Always Allow). This grants access to only that one email-mcp item, nothing else in your Keychain. Note the prompt is tied to the specific Python binary running the server, so it may re-ask if you switch interpreters.

Install

pip install email-mcp        # or: pipx install email-mcp

This provides an email-mcp command (and python -m email_mcp.server).

Configure

  1. Create your account registry at ~/.config/email-mcp/accounts.yml (see config/accounts.example.yml for the format). Override the location with the EMAIL_MCP_ACCOUNTS env var if you prefer.

  2. Store each account's app-specific password in the macOS Keychain:

    python -m email_mcp.setup_cli icloud-personal

    (For local development you can instead set EMAIL_MCP_PASSWORD in a .env.)

Register with Claude Code

claude mcp add email --scope user -- email-mcp

Tools

list_accounts, set_default_account, list_folders, get_emails (recency by default; search via query/filters; per-message attachments metadata), download_attachment, send_email (idempotent; optional attachments), mark_email, move_email.

Security policy

Optional security: section in the accounts file (all patterns are case-insensitive full-match regexes; plain values work as-is — see config/accounts.example.yml):

  • allowed_recipients — when set, every send_email recipient must match one or the send is BLOCKED (recipient_not_allowed) before SMTP and before the dedup ledger. Unset = allow all; an explicitly empty list blocks all sends. Each recipient is first canonicalized to its bare address(es) with the same parser SMTP uses, so a single entry bundling extra addresses behind a comma or display name ("ok@x.com, other@y.com") is checked address-by-address — and that same canonical set is what reaches SMTP and the dedup ledger.

  • Trash is protected by default — the reserved trash names of the major providers (Trash, Bin for Gmail UK, Deleted Messages for iCloud, Deleted Items for Outlook, subfolders included) are read-only: nothing can be moved into or out of them and messages there can't be flagged or expunged. Since moving-to-trash is the only delete this server has, the MCP cannot delete mail at all under the default policy. Opt out with protect_trash: false (applies on the next call). Note: a bare Deleted (some Exchange/O365/Dovecot setups) is not auto-matched — add it to protected_folders.

  • protected_folders — additional read-only folders (same semantics as trash).

  • readable_folders / blocked_folders — gate reading (get_emails, download_attachment, folder listing, and the folder sets searched for mutations). A blocked folder is also refused as a move_email destination. When readable_folders is set only matching folders are readable; blocked_folders always wins. Blocked folders are also omitted from list_folders. Policy violations return structured results (folder_protected, folder_blocked, folders_blocked, recipient_not_allowed) — never exceptions. Config is re-read per call, so edits apply without restarting the server.

Searching & speed

  • get_emails has two modes, reported by searched_window_only in the result:

    • No search terms → fast: the most-recent page*page_size per folder, served from an in-memory cache when warm (a repeat read is ~instant). searched_window_only=true here, so an empty result means "not in the recent window", not "doesn't exist". Pass fresh=true to force a live read.

    • Search (query, from_address, subject, since=YYYY-MM-DD, has_attachment, or raw filters.criteria) → runs server-side over the whole mailboxquery is a full-text IMAP search, so matches outside the recent window are found. searched_window_only=false.

  • body=false omits message bodies (cheap headers + attachment metadata) — ideal for finding a message before opening it. Each message also carries uid/uidvalidity for robust follow-up actions.

  • Background prefetch keeps the latest INBOX warm. Off by default; enable with EMAIL_MCP_PREFETCH_INTERVAL=120 (seconds; delta-fetches only new mail by UID, never marks read). Cache size knobs: EMAIL_MCP_CACHE_ENTRIES (256), EMAIL_MCP_CACHE_BYTES (32MiB), EMAIL_MCP_CACHE_BODY_MAX (64KiB), EMAIL_MCP_CACHE_RECENT_TTL (180s).

  • send_email dedup: by default a 2nd mail to the same recipients within 10 min is BLOCKED. allow_duplicate=true relaxes this to block only a true repeat (same recipients AND subject/body); idempotency_key gives caller-controlled dedup.

Roadmap: running this as one shared HTTP server so a whole fleet of agents share a single warm cache + prefetch — see docs/TODO-http-shared-server.md.

Attachments

  • Reading: get_emails reports an attachments list per message ({index, filename, mime_type, size, inline}) — metadata only, never the bytes. download_attachment(message_id, filename=… | index=…) writes one attachment to disk (read-only; never marks mail read) and returns the saved path. download_all=true saves every attachment; return_base64=true returns small files (≤256KB) inline instead of to disk; uid+folder (from get_emails) locate a message with no/duplicate Message-ID. Files land in EMAIL_MCP_DOWNLOAD_DIR (default ~/.local/state/email-mcp/attachments) unless you pass dest_dir. The email-supplied filename is sanitized and confined to that directory (path-traversal safe); existing files are not clobbered unless overwrite=true.

  • Sending: send_email's optional attachments is a list where each item is either {"path": "/local/file"} (read from disk) or {"content": "<base64>", "filename": "name.ext"}, with an optional "mime_type". Combined size is capped at 25 MB.

Get an app-specific password

  • iCloud: appleid.apple.com -> Sign-In & Security -> App-Specific Passwords.

  • Gmail: myaccount.google.com -> Security -> App passwords.

Develop

python3.12 -m venv .venv && .venv/bin/pip install -e ".[dev]"
.venv/bin/pytest

Available Tools

8 tools
download_attachmentA

Download a message's attachment(s) — read-only, never marks mail read. Select one by filename or index (from get_emails' attachments list); a lone attachment needs neither; download_all=true saves every attachment. Saved into the server download dir (override env EMAIL_MCP_DOWNLOAD_DIR) unless dest_dir is given; the email-supplied filename is sanitized and confined to that directory. return_base64=true returns the bytes inline (small files only, ≤256KB) instead of writing to disk. uid+folder (from get_emails) locate the message directly — use them when a message has no/duplicate Message-ID. Returns {saved_path|content_base64, filename, mime_type, size, ...}.

ParametersJSON Schema
NameRequiredDescriptionDefault
message_idYes
filenameNo
indexNo
dest_dirNo
accountNo
foldersNo
overwriteNo
download_allNo
return_base64No
uidNo
folderNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully bears the burden. It discloses read-only behavior, download methods, base64 limit, file sanitization, and output format, providing comprehensive behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet thorough, front-loading the main purpose and using efficient language. Every sentence adds value without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description explains return values well and covers edge cases (uid/folder) and limitations (base64 size). Missing details on a few schema parameters reduce completeness slightly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must explain parameters. It covers most key parameters (filename, index, dest_dir, download_all, return_base64, uid, folder) but omits 'account', 'folders', and 'overwrite', leaving some gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool downloads a message's attachment(s) and declares it as read-only. It distinguishes itself from sibling tools like get_emails and send_email by specifying its function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on how to select attachments (by filename, index, or lone attachment) and when to use uid/folder. It lacks explicit when-not-to-use instructions but covers key usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_emailsA

Fetch or search emails. Never marks mail read. Defaults to INBOX + Junk.

Two modes, reported by searched_window_only in the result:

  • No search terms: fast — the most-recent page*page_size per folder, served from an in-memory cache when warm. searched_window_only=true here, so an empty result means 'not in the recent window', not 'doesn't exist'. fresh=true forces a live read past the cache.

  • Search (query, from_address, subject, since=YYYY-MM-DD, has_attachment, or raw filters.criteria): runs SERVER-SIDE over the whole mailbox — query is a full-text IMAP search, so matches outside the recent window are found. searched_window_only=false.

body=false omits message bodies (cheap headers + attachment metadata — ideal for finding a message before opening it). cached=true keeps the 60-min result-set cache for stable pagination. Each message includes uid/uidvalidity for robust follow-up actions.

ParametersJSON Schema
NameRequiredDescriptionDefault
accountNo
filtersNo
queryNo
foldersNo
include_sentNo
strip_to_textNo
pageNo
page_sizeNo
cachedNo
bodyNo
from_addressNo
subjectNo
sinceNo
has_attachmentNo
freshNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses key behaviors: never marks mail read, defaults to INBOX+Junk, caching behavior, modes, and result markers like searched_window_only and uid/uidvalidity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear summary and bulleted modes. It is slightly long but every sentence adds value; could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (15 params, no output schema), the description covers modes, caching, pagination, and result fields. Missing details on account selection and attachment handling beyond has_attachment, but overall quite complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Given 0% schema coverage, the description explains many parameters (body, cached, fresh, query, from_address, subject, since, has_attachment, filters.criteria) and the two modes. However, parameters like account, folders, include_sent, strip_to_text, page, page_size are not fully described, though page/page_size are implied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch or search emails' and distinguishes two modes (fast recent vs. full server-side search), which differentiates it from sibling tools like mark_email or send_email.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use each mode and the role of cached vs. fresh results. It does not explicitly mention when not to use this tool or alternatives, but the sibling context and tool names provide adequate guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_accountsA

List accounts and which is the default.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries full burden. It only states it lists accounts and the default, with no mention of authentication, rate limits, or behavior when no accounts exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences with no unnecessary words. Every sentence contributes information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter tool without output schema, the description is mostly adequate. It tells the agent what it returns (list of accounts and default), though more detail on output format or ordering could help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description adds meaning by specifying that it also shows the default account, which is beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'list' and the resource 'accounts', and adds that it identifies the default account. This distinguishes it from siblings like 'set_default_account' and other email-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives, such as 'get_emails' or 'set_default_account'. The description does not specify prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_foldersB

List mail folders (folders the security policy blocks from reading are omitted).

ParametersJSON Schema
NameRequiredDescriptionDefault
accountNo

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It only discloses that folders blocked by security policy are omitted, but says nothing about authentication, rate limits, or behavior when the optional account parameter is omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the key action. While it is not wasteful, it could benefit from a slightly more structured format to include parameter info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (1 optional parameter, no output schema), the description provides the basic purpose and a behavioral caveat. However, it lacks detail on the return format and the exact role of the account parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 1 parameter ('account') with 0% description coverage and no enum. The tool description does not explain the meaning or usage of 'account', leaving its semantics ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List mail folders' with a specific verb and resource, and adds a meaningful qualifier about security policy filtering, distinguishing it from siblings like get_emails or list_accounts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus its siblings (e.g., list_accounts, get_emails). There is no mention of prerequisites or excluded scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mark_emailA

Mark a message read or unread. Refused (folder_protected) for messages in a protected folder — Trash/Bin/Deleted * by default, plus security.protected_folders.

ParametersJSON Schema
NameRequiredDescriptionDefault
message_idYes
readYes
accountNo
foldersNo

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses that the tool may be refused for protected folders, which is a key behavioral trait. However, it does not mention other side effects like notifications or permanence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, concise and front-loaded with the core purpose. No superfluous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and 0% schema description coverage, the tool definition is incomplete. It fails to explain the role of the 'account' and 'folders' parameters, leaving important usage aspects unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, yet the description does not explain the four parameters (message_id and read are self-explanatory, but account and folders are ambiguous). The description should provide more detail on optional parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool marks a message read or unread, using a specific verb and resource. It distinguishes from siblings like move_email and send_email.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions that the tool is refused for messages in protected folders (Trash/Bin/Deleted, plus security.protected_folders), providing a clear when-not-to-use condition. However, it does not explicitly state when to use this tool over alternatives like move_email.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_emailB

Move a message to another folder. Protected folders (Trash/Bin/Deleted * by default, plus security.protected_folders) are read-only: nothing can be moved into or out of them — i.e. with the default policy this server cannot delete mail.

ParametersJSON Schema
NameRequiredDescriptionDefault
message_idYes
dest_folderYes
accountNo
foldersNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior. It explains the constraint about protected folders, which is a key behavioral trait. However, it does not mention side effects (e.g., deletion from source), authorization needs, or reversibility, leaving gaps for a mutation operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with front-loaded purpose and a critical constraint. No wasted words, though it could be restructured to include parameter hints without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is brief for a tool with 4 parameters, no output schema, and no annotations. It lacks details on return values, error handling, and what happens to the original message, making it incomplete for an agent to use reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain any of the four parameters (message_id, dest_folder, account, folders). It only provides high-level purpose, failing to clarify required inputs or their formatting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Move a message to another folder,' providing a specific verb and resource. It adds context about protected folders, which distinguishes its functionality from sibling tools like mark_email or get_emails.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating protected folders are read-only, but it does not explicitly guide when to use this tool versus alternatives (e.g., mark_email). No mention of prerequisites or scenarios where this tool is preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_emailA

Send an email. Idempotent: by default a second mail to the same recipients within 10 minutes is BLOCKED, not resent. allow_duplicate=true relaxes this to block only a true repeat (same recipients AND subject/body), so distinct messages to the same person go through. idempotency_key overrides entirely: blocks iff that key was used in the window (caller-controlled dedup). attachments is an optional list; each item is either {"path": "/local/file"} (read from disk) or {"content": "", "filename": "name.ext"}, with an optional "mime_type". Combined size must stay under 25MB. Note: a {"path"} item reads any file this process can access and emails it — only attach paths you intend to send; never a path derived from untrusted/email-supplied content. If security.allowed_recipients is configured, every recipient must match it or the send is BLOCKED with reason=recipient_not_allowed.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYes
subjectYes
bodyYes
accountNo
tagsNo
attachmentsNo
allow_duplicateNo
idempotency_keyNo

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: idempotency (duplicate blocking, allow_duplicate, idempotency_key), attachment constraints (size, type, security warning), and recipient restriction. This is exceptionally informative.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively long but each sentence adds value, covering essential behaviors. It starts with the core purpose and then adds details in a logical order. Could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given complexity (idempotency, attachments, security) and no output schema, the description covers most aspects. However, it omits expected response format and some parameter details (e.g., account, tags), leaving small gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description covers allow_duplicate, idempotency_key, and attachments in detail, but does not explain 'to', 'subject', 'body', 'account', or 'tags' beyond schema types. Schema coverage is 0%, so description must compensate; it does partially but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Send an email', specifying the verb and resource. Among sibling tools like download_attachment and get_emails, this tool's function is distinct and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Usage is implied by the tool's purpose, but the description lacks differentiation from other email tools or conditions for choosing this one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_default_accountB

Set the default account (used when account is omitted).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It fails to disclose important behavioral traits such as persistence, scope, or side effects of setting a default account.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise at one sentence, and gets straight to the point. However, it sacrifices some completeness for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (1 parameter, no output schema), the description is minimally adequate but lacks context on default account semantics, such as whether the setting is persistent or per-session.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should explain the 'name' parameter beyond its name. It only says 'name' without specifying what it refers to (e.g., account name).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Set the default account' and explains its use case when 'account' is omitted. It distinguishes from sibling tools like list_accounts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a hint about when to use it ('when `account` is omitted'), but does not provide explicit guidance on when not to use it or mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 8 tool updatesv0.1.1
    • First observeddownload_attachment
    • First observedget_emails
    • First observedlist_accounts
    • First observedlist_folders
    • First observedmark_email
    • First observedmove_email
    • First observedsend_email
    • First observedset_default_account

TDQS

A3.8/5.0
Disambiguation5/5

Each tool targets a distinct operation (downloading attachments, fetching emails, listing accounts/folders, marking/moving/sending emails, setting default account). There is no overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern with snake_case (e.g., download_attachment, get_emails, list_folders). No mixing of conventions.

Tool Count5/5

With 8 tools, the server covers core email operations without being too sparse or overly heavy. Each tool serves a clear purpose.

Completeness4/5

Covers essential email operations (send, receive, list, mark, move, attachments) but lacks a direct delete capability; the move_email tool cannot move to protected folders like Trash, limiting deletion.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    B
    maintenance
    A minimal MCP server for reading and sending emails via IMAP/SMTP, supporting multiple accounts in a single instance with zero external dependencies.
    1
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Local IMAP/SMTP MCP server that lets Claude read, search, draft, send, flag, and move mail across multiple IMAP mailboxes. Credentials stay on your machine.
    -
  • A
    license
    A
    quality
    C
    maintenance
    Privacy-first local MCP server for personal @163.com mailboxes, connecting via IMAP/SMTP with read-only search and write operations guarded by confirmation tokens.
    12
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A minimal MCP server for reading, searching, managing, and sending email over IMAP and SMTP.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/swapnilsurdi/email_mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server