The allowlist is enforced on the send path and bypassed on the draft path, and an edit to a draft is checked when it is sent rather than when it is written. The rule tools carry their own warnings instead of leaving you to work them out — a created rule keeps acting on the mailbox after the session ends, and deleting one can silently re-expose the mailbox to mail it was filtering. The project is also honest where honesty costs it something: it says plainly that the read-only profile removes the write tools everywhere, but only narrows the OAuth token on a mailbox that never consented to the write scopes, so on a previously-configured mailbox it is defence in depth rather than a real boundary.
A local email server for agents over Microsoft 365 / Outlook and Gmail: reading, search, threads, attachments, folders, labels, drafts, scheduled sends and server-side inbox rules. Its defaults are the point — an agent cannot send until you configure an allowlist, and the destructive tools are off until you turn them on. An interactive wizard walks the OAuth setup.
- Reading shaped for a model: read_email returns the message as token-efficient markdown, with quoted history and signatures strippable, and raw HTML when that is what you actually need.
- search_emails across one mailbox or all of them with pagination, list_emails filtered by folder, sender and unread status, and get_thread to pull an entire conversation by message id.
- Several mailboxes as first-class citizens: list_mailboxes reports each logical name, its address, provider, connection status and which one is default — including the ones that failed to authenticate.
- A draft path and a send path that behave differently: create_draft, update_draft and send_draft, with sends schedulable, and list_scheduled_sends and cancel_scheduled_send covering provider-held sends that have not gone yet.
- Triage tools: label_email over one id or many, flag_email, mark_read, move_to_folder — which returns the new message id, because the provider assigns one after a move — and list_folders with computed paths for nested folders.
- Attachments through list_attachments and download_attachment, returned inline as base64 under a size ceiling.
- Server-side rules: list_inbox_rules reports every field the provider gives back, and create_inbox_rule builds a persistent rule from conditions, actions, exceptions and a sequence — with forwarding, redirection and deletion blocked outright.
- A read-only scope profile that removes every mailbox-mutating tool from the surface, for a deployment that should only ever observe.
At least one configured mailbox on Microsoft 365 or Gmail, connected through the setup wizard's OAuth flow. A send allowlist, which decides who send_email, reply_to_email and send_draft will actually mail; without one, sending is off. Deletion needs explicit configuration before it runs at all — delete_email, delete_folder and delete_inbox_rule are disabled by default and each also takes an explicit caller flag. The read-only scope profile has to be set for both configuration and runtime, so that the consent granted and the tools exposed agree.
One command — npx -y email-agent-mcp