cancel_scheduled_send
Cancel a pending provider-held scheduled send. Only verified scheduled drafts can be cancelled.
LABSCO SUMMARY
Composing is unrestricted and sending is not, so an agent can write the whole reply and still be unable to mail a stranger.
The allowlist is enforced on the send path and bypassed on the draft path, and an edit to a draft is checked when it is sent rather than when it is written. The rule tools carry their own warnings instead of leaving you to work them out — a created rule keeps acting on the mailbox after the session ends, and deleting one can silently re-expose the mailbox to mail it was filtering. The project is also honest where honesty costs it something: it says plainly that the read-only profile removes the write tools everywhere, but only narrows the OAuth token on a mailbox that never consented to the write scopes, so on a previously-configured mailbox it is defence in depth rather than a real boundary.
What it is
A local email server for agents over Microsoft 365 / Outlook and Gmail: reading, search, threads, attachments, folders, labels, drafts, scheduled sends and server-side inbox rules. Its defaults are the point — an agent cannot send until you configure an allowlist, and the destructive tools are off until you turn them on. An interactive wizard walks the OAuth setup.
What you get
- Reading shaped for a model: read_email returns the message as token-efficient markdown, with quoted history and signatures strippable, and raw HTML when that is what you actually need.
- search_emails across one mailbox or all of them with pagination, list_emails filtered by folder, sender and unread status, and get_thread to pull an entire conversation by message id.
- Several mailboxes as first-class citizens: list_mailboxes reports each logical name, its address, provider, connection status and which one is default — including the ones that failed to authenticate.
- A draft path and a send path that behave differently: create_draft, update_draft and send_draft, with sends schedulable, and list_scheduled_sends and cancel_scheduled_send covering provider-held sends that have not gone yet.
- Triage tools: label_email over one id or many, flag_email, mark_read, move_to_folder — which returns the new message id, because the provider assigns one after a move — and list_folders with computed paths for nested folders.
- Attachments through list_attachments and download_attachment, returned inline as base64 under a size ceiling.
- Server-side rules: list_inbox_rules reports every field the provider gives back, and create_inbox_rule builds a persistent rule from conditions, actions, exceptions and a sequence — with forwarding, redirection and deletion blocked outright.
- A read-only scope profile that removes every mailbox-mutating tool from the surface, for a deployment that should only ever observe.
Requirements
At least one configured mailbox on Microsoft 365 or Gmail, connected through the setup wizard's OAuth flow. A send allowlist, which decides who send_email, reply_to_email and send_draft will actually mail; without one, sending is off. Deletion needs explicit configuration before it runs at all — delete_email, delete_folder and delete_inbox_rule are disabled by default and each also takes an explicit caller flag. The read-only scope profile has to be set for both configuration and runtime, so that the consent granted and the tools exposed agree.
Setup effort
One command — npx -y email-agent-mcp
USE CASES
01
Working an inbox down without sending anything by accident
List and read what came in, mark, label and file it — the send path stays closed unless you opened it.
02
Drafting a reply for a person to send
Pull the whole thread for context, write the draft into it, and leave the send for a human — a draft is never a sent message.
03
Scheduling a send you can still call back
Schedule it with the provider, list what is pending, and cancel before it goes if the answer changes.
04
Getting a file back out of a thread
List the attachments on the message and pull the one you want back inline, under the size ceiling.
05
Making the sorting outlast the session
Create a server-side rule so the mailbox keeps filing on its own, and read back the rules already in place before adding another.
06
Running one agent across several mailboxes
Enumerate what is configured, see which ones authenticated, and target a specific mailbox by its logical name.
26 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
create_draft
Create an email draft. Supports body_file with YAML frontmatter. Use reply_to for threaded reply drafts; pass reply_all=false with reply_to to draft a sender-only reply.
create_folder
Create a custom child mail folder (defaults to a child of Inbox)
create_inbox_rule
Create a persistent server-side inbox rule using safe actions only; forwarding, redirection, and deletion are blocked. Confirm with the user before calling — this creates a rule that keeps acting on the mailbox 24/7 after the session ends.
delete_email
Delete an email (disabled by default, requires explicit configuration)
delete_folder
Delete a custom mail folder, including any mail it contains (disabled by default, requires explicit configuration). Well-known/system folders are protected.
delete_inbox_rule
Delete a server-side inbox rule by id (disabled by default, requires explicit configuration). Removing a rule can silently re-expose the mailbox to mail the rule was filtering.
download_attachment
Download a single attachment as inline base64. Default max_size_mb=5 (hard ceiling 25). File attachments only — Microsoft item/reference attachments return NOT_SUPPORTED.
flag_email
Flag or unflag an email as important/starred
get_mailbox_status
Get mailbox connection status, unread count, and warnings
get_thread
Retrieve all messages in a conversation thread by message ID. A thread can end with an unsent draft reply: a message with isDraft: true has NOT been sent, so it is not a sent reply — though earlier sent replies from the same author may exist elsewhere in the thread. Never describe such a message as a sent, delivered, or received email.
label_email
Apply labels or categories to one or more emails
list_attachments
List attachments for a specific email message
list_emails
List recent emails with filtering by unread status, folder, sender, and limit. Use offset for pagination. A row with isDraft: true is an unsent draft — it has NOT been sent, and its receivedAt is provider-supplied metadata, not evidence of delivery. Never describe such a row as a sent, delivered, or received email.
list_folders
Recursively list mail folders, including computed paths for nested folders
list_inbox_rules
List server-side inbox rules with all fields reported by the provider
list_mailboxes
List every configured mailbox: its logical name (pass this as the mailbox argument to other tools), its emailAddress, provider, connection status, and which one is the default. Reports mailboxes that failed to authenticate too, so it stays useful for diagnosing a broken setup.
list_scheduled_sends
List pending provider-held scheduled sends for a mailbox
mark_read
Mark an email as read or unread
move_to_folder
Move an email to a specific folder (inbox, archive, trash, etc.). Returns the new message ID since Graph assigns a new ID after moving.
read_email
Read the full content of an email by ID, transformed to token-efficient markdown. When the response has isDraft: true the message is an unsent draft — it has NOT been sent, and receivedAt is provider-supplied metadata, not evidence of delivery; never describe it as a sent, delivered, or received email. Set format to 'html' to get the raw body HTML instead of markdown — use this when you need to preserve inline styling (colour, background-colour, underline, strikethrough) that the markdown conversion discards, e.g. to change one sentence of a formatted body and leave the rest alone. Raw HTML costs far more tokens than markdown, so leave the default alone unless you need the styling; check bodyFormat (text means the message had no HTML part, so do not send it as HTML) before writing a body back, and never write one back with bodyTruncated: true — you do not have the whole body. strip_quoted_history and strip_signatures are markdown-shaped text transforms and are NOT applied when format is 'html'; the HTML is returned verbatim. To write it back, call create_draft/update_draft with format: 'html' AND force_black: false — force_black defaults to true and wraps your HTML in a force-black div, so leaving it on nests another wrapper on every round trip. Set strip_quoted_history to true to drop the terminal "On … wrote:" / Outlook-header / >-prefix reply chain and replace it with a short marker. Set strip_signatures to true to remove detected signatures and legal disclaimers; it defaults to false here for MCP compatibility even though the core action defaults to true.
reply_to_email
Reply to an email within an existing thread. Default reply_all=true cc's the original thread; pass reply_all=false to reply only to the sender. Send path validates all effective recipients against the send allowlist; draft path bypasses.
search_emails
Search emails using full-text query across one or all mailboxes. Use offset for pagination. Results include unsent drafts: a row with isDraft: true has NOT been sent — its receivedAt is provider-supplied metadata, not evidence of delivery. Never describe such a row as a sent, delivered, or received email.
send_draft
Send a previously created draft. Enforces send allowlist before sending. Rate-limited.
send_email
Compose and send a new email. Gated by send allowlist. Draft mode bypasses allowlist.
update_draft
Update a draft email. Body edits are refused for reply drafts; non-reply body edits require replace_body=true and replace the body wholesale. Subject, recipients, and attachments remain editable. Allowlist is enforced at send_draft time, not here.
BEFORE YOU INSTALL
What to know first
Tools you get
26 tools when we connected. EMAIL_AGENT_MCP_SCOPE_PROFILE=observe removes mailbox-changing tools and list_inbox_rules. The six folder and inbox-rule tools return NOT_SUPPORTED on Gmail, and delete_email, delete_folder and delete_inbox_rule need an operator env var plus a per-call flag.
Requires
npx on PATH
CONTEXT COST
Moderate Standing cost
Rated by the size of the 26 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y email-agent-mcpRun this once in a terminal first: its interactive setup wizard walks you through the OAuth sign-in and mailbox selection (npx email-agent-mcp configure runs the wizard on its own). Your client then launches the same command as the server.
MCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"email-agent-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"email-agent-mcp"
]
}
}
}Cursor
CURSOR · JSON
{
"mcpServers": {
"email-agent-mcp": {
"command": "npx",
"args": [
"-y",
"email-agent-mcp"
]
}
}
}Gemini CLI
GEMINI CLI · TERMINAL
gemini extensions install https://github.com/UseJunior/email-agent-mcp
