Mailbox MCP
Connect a mailbox

Compare

The free Gmail and Outlook connectors, compared job by job.

Claude, ChatGPT, Copilot and Gemini each come with a Gmail or Outlook connector of their own. Here's what each one says it does with the jobs people actually ask for, in the vendors' own words, beside the same jobs done through Mailbox MCP and photographed in a real mail client.

  • Compared 7 free connectors
  • Vendors read on 1 October 2026
  • Every picture A real mail client

By Mark McNeece, Founder Published Editorially reviewed by Mark McNeece on Editorial standards

At a glance

Gmail and Outlook connectors in Claude and ChatGPT, compared

Every job on this page, for the 7 free connectors people actually have: Claude's Gmail and Microsoft 365 connectors and its Outlook add-in, ChatGPT's Gmail and Outlook apps, Copilot in Outlook and Gemini in Gmail.

Each of their cells was read from that vendor's own pages on . The S number under it is the page it rests on, listed under Sources. Mailbox MCP's column is first, and every row of it is done for real further down this page.

Yes
The vendor says it does.
No
The vendor says it does not, or its complete published tool list has no tool for it.
Partly
A yes, on the condition written under it.
Not stated
The pages that would say were read and do not. A blank the vendor left, not a finding against them.
Job Mailbox MCP Claude, Gmail Claude, Microsoft 365 Claude for Outlook ChatGPT, Gmail ChatGPT, Outlook Copilot in Outlook Gemini in Gmail
Reply in the same thread Yes YesS1 S46 YesS6 PartlyDrafts it; you sendS7 Not statedS13 Not statedS14 PartlyDrafts it; you sendS24 Not statedS45
Send a new email with an attachment Yes NoNot on a draftS46 NoS4 NoNever sendsS7 Not statedS13 Not statedS14 Not statedS24 Not statedS45
Read what is inside an attachment Yes NoS1 S47 Not statedS6 PartlyWord and Excel, not PDFS7 Not statedS11 PartlyYour own mailbox onlyS14 PartlyNew Outlook and the webS52 Not statedS45
Forward with its attachments Yes PartlyForwards; files not statedS2 NoS4 PartlyDrafts it; you sendS7 Not statedS13 Not statedS14 Not statedS23 Not statedS45
Add a Cc YesBcc refused on purpose PartlyOn a draftS46 Not statedS6 Not statedS7 Not statedS13 Not statedS14 Not statedS24 Not statedS45
Save a draft into the mailbox Yes YesS46 YesS6 NoCompose window onlyS7 PartlyWhere it is kept, not statedS13 PartlyWhere it is kept, not statedS13 PartlyIn the compose windowS24 PartlyWhere it is kept, not statedS45
Edit a draft already saved YesOne marked as a draft YesS2 YesS6 Not statedS7 Not statedS13 Not statedS14 PartlyText you selectS24 PartlyFor toneS45
Archive, move, junk, flag, mark read Yes PartlyBy labelS48 S2 PartlyTrash and categoriesS6 PartlyArchive, move, flagS7 Not statedS11 S13 PartlyShared mailboxes onlyS14 YesS23 PartlyOn paid plansS45
Says reading leaves it unread Yes Not statedS1 Not statedS6 Not statedS7 Not statedS11 Not statedS14 Not statedS23 Not statedS45
A mailbox that is not Gmail or Outlook Yes NoS1 NoS4 NoS7 Not statedS51 Not statedS51 PartlyIn new Outlook, with a licenceS27 NoS39
The same connection in another AI Yes Not statedS1 Not statedS6 Not statedS7 Not statedS13 Not statedS14 Not statedS23 Not statedS45
Several mailboxes in one chat YesOne connector each NoS1 Not statedS6 Not statedS7 YesS13 PartlyWhere supportedS13 S14 Not statedS23 Not statedS45
Calendar beside the mail Yes YesS1 YesS6 PartlyDrafts invitesS7 YesS11 YesS14 YesS20 YesS45
Contacts beside the mail Yes Not statedS1 NoS6 Not statedS7 PartlyRead onlyS11 YesS14 Not statedS20 Not statedS45
Can be kept from sending YesA drafts-only level PartlyAsks first, by defaultS1 YesRead only by defaultS4 YesNever sendsS7 PartlyMay ask firstS50 PartlyMay ask firstS50 Not statedS23 Not statedS45

Attachments are where the free connectors stop short

  • 5 ways to attach a file

    A file already in the mailbox, a web link, an upload link you drop files on, an image ChatGPT has just made, or a small one the AI writes. None of the 7 free connectors publishes any of the first 4.

  • Reads what is inside

    PDFs and scanned pages, Word, Excel with its formulas worked out, PowerPoint and photos. The free ones publish metadata, or some of those types.

  • Forwards the files, keeps none

    A forward carries its attachments, an upload waits in your own Drafts, and a download streams from your mail server. Nothing is kept on our systems.

The row nobody fills in is the one about reading. No vendor, on any page behind this table, says what an ordinary read does to a message's read state. That decides whether an AI going through your inbox leaves you any way to tell what you haven't looked at.

It was true on 30 August 2026, and it's still true. Ours leaves mail unread, and the filing section shows it.

Each job below shows Mailbox MCP doing it in a real mail client, and here is everything Mailbox MCP does.

Already decided on an MCP server rather than a built-in connector, and want to know how the hosted ones differ? That's a separate table: the best email MCP servers for your own inbox.

The choice

A Claude or ChatGPT email connector, or an MCP server?

A Claude email connector, or ChatGPT's, is built into that AI and works Gmail or Outlook inside it. An MCP server such as Mailbox MCP is a separate service you add to the same AI, and it's built around the mailbox rather than the assistant:

The table above has the vendors' own words for each of these, and the jobs below show each one done in a real mail client.

Job 1: replies

Can Claude or ChatGPT reply in the same email thread?

A reply that lands as a loose message beside the conversation, not inside it, is the first thing people notice about a mail tool built for a demo. Whether it lands inside depends on 2 headers the reply has to carry: In-Reply-To and References.

What the free connectors say

  • Claude, GmailYesS1

    Send, reply to, and forward emails from Gmail. By default, Claude asks for your approval before each of these actions.

  • Claude, Microsoft 365YesS6

    Create a reply draft on a message.

    Then "Send an existing draft", as a second tool.

  • Claude for OutlookPartlyDrafts it; you sendS7

    Draft replies, reply-alls, and forwards in your voice, landed unsent in Outlook's compose pane.

  • Copilot in OutlookPartlyDrafts it; you sendS24

    Edit the draft as needed, and then select Send.

  • ChatGPT and GeminiNot statedS13 S45

    ChatGPT says it drafts and sends from Gmail and Outlook; neither it nor Gemini says a reply is threaded.

Not one of them says which headers the reply carries. Google's create_draft tool asks for the original message's ID when a draft is a reply, which is the right input, and stops there.

What Mailbox MCP does

Every reply carries both headers, built from the message it answers. And:

  • The recipients come from that message (its Reply-To, otherwise its sender), not from anything the AI types.
  • If a Reply-To points somewhere the message didn't come from, the tool refuses until the AI names that address.
  • Reply-all keeps the original Cc and takes your own addresses out.
  • The original is marked answered, which is the reply arrow in Outlook, and the Sent copy is filed once.

We checked the threading in Outlook when it was built. Below, the same reply sits under the quote it answers, in webmail.

Reply to Priya: Monday 12 October is fine, we start at 8 and keep the noisy work until after they close at 3. Say the quote and the safety notes are coming separately.

Worked for 9.9s

  1. search_emails Searching for mail from "priya" 161ms
  2. read_email Opening "Re: Quote Q-2291: cafe counter and shelving" 104ms
  3. reply_email Replying to that message 9679ms

Sent to Priya Shah as a reply to her message about the quote, saying Monday 12 October from 8am, with the noisy work kept until after 3.

She had also asked you to resend the quote and the health and safety notes, so the reply says both are coming in a separate email.

A copy is filed in Sent, and her message is marked as answered, so it shows the reply arrow in Outlook and webmail.

Most of that time is the send waiting to see whether the mail host files its own Sent copy, so there is only ever one.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

Webmail showing the Sent folder in threaded view: the reply "Re: Quote Q-2291: cafe counter and shelving" nested under the original quote, and open beside it with Priya Shah's message quoted beneath it.
The reply the AI sent, in webmail: nested under the quote in the thread, with her message quoted beneath

There is more on how a reply is built, and why the recipients never come from the AI, in the guide to letting an AI reply to your email.

Job 2: attachments out

Can Claude or ChatGPT send an email with an attachment?

The quote a client can't find, the certificate an insurer asked for, the invoice for the accountant: a great deal of business email exists to carry a file. This is where the free Gmail and Outlook connectors are weakest, and 2 of them say so in writing.

The whole subject, sending, reading and saving, has its own page: AI email attachments.

What the free connectors say

  • Claude, Microsoft 365NoS4

    Attachments aren't supported in write tools, so sending, forwarding, and drafting all reject messages with attachments.

  • Claude, GmailNoS46 S3

    Limitation: Creating drafts with attachments is not supported yet.

    Google's page for its send tool answers 404, so for a new message it is not stated.

  • Claude for OutlookNoNever sendsS7

    Claude never sends mail or invites on its own.

  • ChatGPT, Copilot, GeminiNot statedS13 S24 S45

    ChatGPT sends from Gmail and Outlook; none of the three says a file can go with it.

The one route any of them documents is the expensive one, on the same Google page that says it isn't supported yet. Each file in create_draft's attachments field is "The base64-encoded content of the attachment".

That means the AI writes the whole file out as text: about a third bigger than the file, and roughly 900,000 tokens of output for every megabyte on OpenAI's models and 1.3 million on Claude's, measured on real files. Past a small size, the conversation runs out of room before the file does.

What Mailbox MCP does

A file gets into a message 5 ways, and none of the 7 free connectors publishes any of the first 4.

  • A file already in the mailbox is attached by reference, so the quote you sent last week goes out again without being found or uploaded.
  • A file at a web address is fetched by the server.
  • A file on your own computer goes through a one-off upload link you drop it on. It waits in your own Drafts folder, not on our servers, until it's attached.
  • In ChatGPT, a file in the chat itself, such as an image it has just made, is handed over as a link and fetched the same way. So ChatGPT can make a picture and email it without anybody downloading it.
  • Only a small file the AI writes itself travels as base64, the last resort.

The first 4 are picked up at the moment of sending and never pass through the conversation. So a 6 MB PDF costs the AI about what a sentence does, and the length of the chat sets no limit.

The whole message can carry up to 20 MB. What arrives is an ordinary attachment under its own name: we measured the bytes on arrival, and they were SHA-256 identical (an exact, byte-for-byte match).

Send Priya the quote again, the HSE toolkit at hse.gov.uk/pubns/indg344.pdf, and the programme as a spreadsheet: strip out Monday, counter carcass Tuesday, worktops and shelving Wednesday, finish and hand over Thursday.

Worked for 11.5s

  1. search_emails Searching Sent for "Q-2291" 177ms
  2. read_email Opening "Quote Q-2291: cafe counter and shelving" in Sent 86ms
  3. send_email Sending with 3 files: 1 by reference, 1 by web address, 1 written here 11253ms

Sent to Priya with 3 attachments:

  • Quote-Q-2291-Brightwater.pdf, the file on the quote you sent her on Tuesday, attached by reference.
  • indg344.pdf, which the server fetched from the HSE's address at the moment of sending.
  • Brightwater-programme.csv, the 4 days as you gave them, which I wrote.

The first two never passed through this chat. A copy of the message is filed in Sent.

3 of the 4 routes a file can take into a message, in one send. The fourth is an upload link for a file on your own computer.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

  1. A file already in the mailbox

    The invoice somebody sent, the quote that went out last week. The server copies it across from the message it arrived in.

    Never through the conversation

    None of the 7 free connectors publishes this route.

  2. A file at a web address

    A shared Drive, Dropbox or SharePoint link, or any https address. The server fetches it while the message is built.

    Never through the conversation

    None of the 7 free connectors publishes this route.

  3. A file on your own computer

    The AI hands you a one-off upload link and you drop the files on it. They wait in your own Drafts folder, not on our servers, until they are attached.

    Never through the conversation

    None of the 7 free connectors publishes this route.

  4. A file in your ChatGPT conversation

    An image ChatGPT has just made, a document it built, a file you dropped into the chat. ChatGPT hands the server a link and it is fetched like any other, so nothing is downloaded first.

    Never through the conversation

    None of the 7 free connectors publishes this route, ChatGPT's own Gmail and Outlook apps included.

  5. A small file the AI writes itself

    An invitation, a short CSV. The AI writes it out as base64, so it is kept under about 50 KB, and anything bigger goes by upload link instead.

    Through the conversation

    Google's Gmail server takes base64 on create_draft, on a page that also says drafts with attachments are not supported yet.

One message

20 MB of attachments, every file on the message together

The first 4 are fetched by the server while the message is built, so a file's size never reaches the conversation and there is no limit from the conversation's length. Only the last passes through it.
Webmail showing the sent message "Quote Q-2291, safety notes and the programme" with 3 attachments: Quote-Q-2291-Brightwater.pdf, indg344.pdf and Brightwater-programme.csv.
The message as it was sent: a file from the mailbox, a file from the web, and a file the AI wrote

Sending the file is the job the built-in connectors stop short of. Try it on your own mailbox: the free tier is 5 calls a day with no card.

Connect a mailbox Sign in

Job 3: attachments in

Can Claude read email attachments? What each connector opens

"What does this invoice come to" is a question about the file, not the email. Plenty of invoices arrive in an email that says only "please find attached".

The answer depends on which free connector you have, and none of them says it reads every kind of file you get.

What the free connectors say

  • Claude, GmailNoS1

    Access email metadata, including attachment metadata (not attachment content)

  • Claude for OutlookPartlyWord and Excel, not PDFS7

    PDF attachments are not currently read inline; save the file and upload it through the sidebar instead.

  • Copilot in OutlookPartlyNew Outlook and the webS52

    If you're using new Outlook and the email has attachments (PDF, PowerPoint, or Word), you can select Summarize a file.

    The same page says the same of Outlook on the web.

  • ChatGPT, OutlookPartlyYour own mailbox onlyS14

    The list_attachments and fetch_attachment actions work only with messages in the signed-in user's mailbox.

  • Claude, Microsoft 365; ChatGPT, Gmail; GeminiNot statedS6 S11 S45

What Mailbox MCP does

The server opens the file and hands the AI what's in it:

  • a PDF, a Word document, a spreadsheet (one block per sheet, formulas computed) or a slide deck, as text;
  • a photo, or a scanned page with no text on it, as a picture, so a signed letter is read the way you'd read it.

It works out what a file is from its bytes, not from what it claims to be. A program, a script or a macro-enabled document is named as a hazard rather than opened.

Each file is read in a process of its own, with a memory ceiling and a time limit. Nothing is kept afterwards, and reading a file doesn't mark the message read.

Every attachment also comes back with a download link that streams it straight from your mail server for 15 minutes, so the AI can put the file itself in front of you.

That's further than any free connector publishes. The widest reading among the 7 is Word and Excel in Claude for Outlook, and a summary of a PDF, PowerPoint or Word file from Copilot in new Outlook and Outlook on the web.

None of them says it works out a spreadsheet's formulas, goes through a deck slide by slide or reads a scanned page as a picture. And Claude's Gmail connector reads an attachment's metadata, not what's in it: when we tested it on 6 October 2026 it got into a 1 KB PDF only by pulling the whole raw email through the chat, and couldn't open a 1.6 MB one. The test, with Claude's own words.

Simon Willison, who named the risk the rest of this section answers, put the email half of it bluntly:

Something as simple as a tool that can access your email? That's a perfect source of untrusted content: an attacker can literally email your LLM and tell it what to do!

Simon Willison, The lethal trifecta for AI agents, 16 June 2025

An attachment is that sentence one level deeper. Its name, its declared type and every word inside it were chosen by whoever sent it.

That's why this server decides what a file is by its bytes, reads it where a hostile file can only take down its own process, and fences what it found as content, not instruction, before the AI sees it.

None of the free connectors that read attachments describes doing any of that. But Anthropic's add-in page does say the thing that matters, in a sentence worth quoting in full: "Email bodies and attachments are untrusted input and may contain instructions intended to manipulate Claude rather than you."

What does Kestrel's invoice come to, and when is it due?

Worked for 2.8s

  1. search_emails Searching for mail from "kestrel" 163ms
  2. read_email Opening "Invoice KT-2207" 105ms
  3. read_attachment Reading the text inside Kestrel-Invoice-KT-2207.pdf 2548ms

The email only says the invoice is attached, so I read the PDF itself. It comes to £1,566.00: £1,305.00 plus £261.00 VAT.

That is 3 oak worktops at £388.00 each (£1,164.00), cutting and edge oiling (£96.00) and delivery (£45.00).

Payment is due on 23 October 2026, 30 days from the invoice date of 23 September.

The figures came from inside the file. The message they arrived in names none of them.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

The Kestrel Timber invoice KT-2207 opened in webmail's PDF viewer: 3 oak worktops, cutting and delivery, subtotal GBP 1,305.00, VAT GBP 261.00, total due GBP 1,566.00, payment due 23 October 2026.
The PDF the AI read, opened in webmail: every figure in its answer is on this page and none is in the email

The long answer, with what each Claude product reads, is in can Claude read my email, and the same for ChatGPT in can ChatGPT read my email.

Job 4: forwards

Forwarding an email with its attachments, and filing a received file

A forward whose attachment didn't come with it is worse than no forward, because it looks done. The invoice to the bookkeeper is the classic case.

What the free connectors say

  • Claude, Microsoft 365NoS4

    Attachments aren't supported in write tools, so sending, forwarding, and drafting all reject messages with attachments.

  • Claude, GmailPartlyForwards; files not statedS2 S3

    A tool named forward is on Anthropic's listing; Google's page for it answers 404, so what happens to the attachments is not stated anywhere.

  • Claude for OutlookPartlyDrafts it; you sendS7

    Draft replies, reply-alls, and forwards in your voice, landed unsent in Outlook's compose pane.

  • ChatGPT, Copilot, GeminiNot statedS14 S23 S45

What Mailbox MCP does

A forward carries the original's attachments and its inline images, under their own names. Anything that would take the message past 20 MB is named in the result as left behind, never dropped quietly. A draft forward files the same thing in Drafts for you to send.

"Filing" a received file means one of 3 things here, so it's worth being exact:

  • The message can be forwarded with the file, as above.
  • The file can be attached by reference to any new message, reply or draft, including a draft already in Drafts, because editing a draft takes the same attachment list.
  • The message can be moved to a folder.

What it doesn't do is lift a file out of a message and store it on its own. A mailbox holds messages, and the file stays inside the one it came in.

And none of it lands on our systems. A file being forwarded, sent or read passes through memory on its way, and is written nowhere here.

An upload waits in your own Drafts folder until it's attached. A download link streams the file from your mail server and stops working after 15 minutes. What's kept at all, which is never a message or a file, is set out on the privacy page.

Forward Kestrel's invoice to Jess for the books, jess@morenobooks.example.org, and tell her it's due on 23 October.

Worked for 13.6s

  1. search_emails Searching for mail from "kestrel" 142ms
  2. forward_email Forwarding "Invoice KT-2207" to Jess 13488ms

Forwarded to Jess with your note about the 23 October due date.

Kestrel-Invoice-KT-2207.pdf went with it: the server carried the original attachment across, so nothing was downloaded or attached again.

A copy is in Sent, and Tom's message is marked as forwarded.

The file travelled mailbox to mailbox under its own name.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

Webmail showing the sent forward "Fwd: Invoice KT-2207" to Jess, with Kestrel-Invoice-KT-2207.pdf attached, a short note, and the original message quoted under a forwarded-message header.
The forward as it went: the original PDF carried across, the original message quoted below the note

Job 5: copies

Cc on an email the AI sends, and why Bcc is refused

Copying a colleague in is the smallest job on this page, and the vendors say almost nothing about it.

What the free connectors say

  • Claude, GmailPartlyOn a draftS46

    Optional. The carbon copy recipients of the email draft.

    The same page lists blind carbon copy recipients too. For a message sent directly, not stated.

  • Every other connectorNot statedS6 S7 S13 S14 S24 S45

What Mailbox MCP does

Cc works on every send, reply, forward and draft, and a reply-all keeps the original Cc as it was.

Bcc is refused, on every path, on purpose. A blind copy isn't a Cc with one more name. Sent the obvious way, through a server that keeps the message in Sent, the copy filed in your Sent folder carries the blind-copy list for anybody who opens it later. And the people on the list can receive nothing at all.

So the server refuses a Bcc, refuses to send a draft that carries one, and says to send that one from your own mail client. A tool that tells you what it won't do is one you can trust with the rest.

Tell Laura we can quote for the wardrobes, and copy Dan in (dan.hughes@example.com) so he can arrange a visit.

Worked for 9.5s

  1. search_emails Searching for mail from "laura" 155ms
  2. reply_email Replying to Laura, Dan in Cc 9382ms

Sent to Laura Pike with Dan Hughes in Cc, as a reply to her enquiry about the loft wardrobes.

Laura's address was taken from her own message rather than typed by me; Dan's is the Cc you gave.

A copy is filed in Sent and her message shows the reply arrow.

A Cc, yes. A Bcc is refused on purpose, for the reason set out beside this.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

Webmail showing the sent reply "Re: Fitted wardrobes for a loft room" from Alex Reed to Laura Pike, with dan.hughes@example.com on the Copy line.
The reply to Laura in Sent, with Dan on the Copy line and her address taken from her own message

Job 6: drafts

Saving an email draft and editing it later

"Write it but don't send it" is how most people start trusting an AI with mail. It only works if the draft is somewhere your own mail client can open it, and if asking for a change edits that draft rather than leaving a second one beside it.

What the free connectors say

  • Claude, GmailYesS46 S2

    Creates a new draft email in the authenticated user's Gmail account.

    An update_draft tool is on Anthropic's listing, by name.

  • Claude, Microsoft 365YesS6

    Update an existing draft

  • Claude for OutlookNoCompose window onlyS7

    Every draft lands unsent in Outlook's compose or appointment form, and you click Send.

  • Gemini in GmailPartlyWhere it is kept, not statedS45

    Draft: Create new emails or refine existing drafts for tone and clarity.

  • ChatGPT and CopilotNot statedS13 S24

    ChatGPT will "create a draft" without saying where it is kept; Copilot drafts in the compose window and rewrites text you select.

What Mailbox MCP does

A draft is saved into the mailbox's own Drafts folder, marked as a draft, where Outlook, Thunderbird, webmail or a phone can open, change, send or delete it.

Asked for a change, the AI rewrites that draft. IMAP has no edit in place, so the new version is saved and the old one removed, which is what Outlook and Thunderbird do when you edit one. A reply draft keeps its thread and its attachments through the edit.

It will edit a draft another program wrote on one condition, and we found the condition by doing it: that program has to have marked it as a draft.

The webmail in these pictures saves its drafts without that mark. So the tool refused to edit one, rather than replace something that might be ordinary mail, and the pictures below are of a draft the AI started and then changed.

Draft a note to Calder Van Hire asking to keep the van an extra day. Don't send it.

Worked for 126ms

  1. draft_email Saving a draft to bookings@caldervans.example.com 126ms

Saved in your Drafts folder, not sent.

It is an ordinary draft in the mailbox, so you can open it in any mail client to change it, send it or delete it.

The first picture below is this draft, opened in webmail.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

Webmail showing the Drafts folder with one draft, "Van booking" to bookings@caldervans.example.com, reading "Could we keep the van for an extra day?".
Before: the draft the AI saved, in Drafts, where webmail shows it as a draft
Webmail showing the same Drafts folder after the edit: still one draft, now "Van booking CVH-58213: keep it until Friday 16 October", with dan.hughes@example.com on the Copy line.
After: one draft still, rewritten with the booking reference and a Cc, and still not sent

Job 7: filing

Filing email with AI: archive, move, junk, flag, and leaving it unread

Filing is where the free email connectors differ most. Most of them file only partly, on a paid plan or on a condition.

What the free connectors say

  • Copilot in OutlookYesS23

    Copilot performs the requested action and updates your mailbox in Outlook automatically.

    Its list: flag, mark read or unread, archive, delete, move, copy, junk, categories and folders.

  • Gemini in GmailPartlyOn paid plansS45

    This feature requires an eligible Google Workspace or Google AI plan.

    Archive, delete, label, mark read or unread and star, each confirmed first. No new labels and no bulk spam.

  • Claude, GmailPartlyBy labelS48 S2

    Can be a system label ID (e.g., 'INBOX', 'TRASH', 'SPAM', 'STARRED', 'UNREAD', 'IMPORTANT') or a user-defined label ID.

    Taking INBOX off is archiving and taking UNREAD off is marking read, though neither vendor uses those words.

  • Claude, Microsoft 365PartlyTrash and categoriesS6

    Trash, categories and inbox rules are in the published tool list; move, flag and mark read are not.

  • ChatGPT, OutlookPartlyShared mailboxes onlyS14

    For supported shared or delegated mailboxes, ChatGPT can read messages, browse folders, mark messages as read or unread, move messages, and send plain-text email from or on behalf of the mailbox.

And the question none of them answers: what an ordinary read does to the read flag. Ask an assistant to go through 80 unread messages and tell you which need you. If reading sets the flag, you've lost the only marker you had for what you haven't looked at, with no undo for it.

What Mailbox MCP does

Reading never marks anything read. Marking read is a separate tool that runs when you ask. In the first picture below, the AI has already read 4 of these messages, replied to 2 and forwarded 1, and every one is still unread.

  • Archive goes to the provider's own archive: Microsoft 365's Archive folder, Gmail's All Mail with the Inbox label taken off, and on a mailbox that has none, a folder made for it the way Thunderbird's Archive button makes one.
  • Junk and Trash are found by the folder's role, never by guessing its name.
  • A move keeps the message's flags and its original date. Delete moves to Trash.
  • A new folder is subscribed, so Outlook shows it.

Tidy my inbox: archive the van booking, put Northfield's offers in a Suppliers folder, junk that parcel message, and flag Kestrel's invoice so I pay it.

Worked for 914ms

  1. list_emails Reading the 7 messages in INBOX 143ms
  2. archive_email Archiving the van booking 277ms
  3. create_folder Creating "Suppliers" 121ms
  4. move_email Moving Northfield's offers into it 120ms
  5. mark_junk Moving the parcel message to Junk 148ms
  6. flag_email Flagging "Invoice KT-2207" 105ms

Done:

  • The van booking is in Archive. This mailbox had no Archive folder, so one was made.
  • Suppliers is a new folder, holding Northfield's autumn prices.
  • The parcel message is in Junk.
  • Kestrel's invoice is flagged and still in the inbox.

All 7 were still unread when I listed them, including the 4 I had read or replied to for you earlier today.

Filed, flagged, and nothing marked read that you had not read. The two pictures below are the inbox before and after.

Tool calls, results and timings recorded against a real mailbox on 24 September 2026; the assistant's replies are written to match them. The correspondents are invented and on reserved example domains, so nothing sent reached anybody.

Webmail inbox with 7 messages, all in bold as unread: reply arrows on Laura Pike's and Priya Shah's messages and a forward arrow on Kestrel's invoice.
Before filing: read, replied to and forwarded by the AI, and all 7 still unread
The same inbox after filing: 4 messages left, all unread, Kestrel's invoice flagged in red, and new Archive and Suppliers folders in the folder list.
After: 3 filed away, the invoice flagged, Archive and Suppliers in the folder list

What a sensible filing pass looks like, and how to ask for one, is in the guide to filing email with AI.

Job 8: any mailbox

Mailboxes that are not Gmail or Outlook: IMAP, and who reaches it

Here the answer is nearly the same for all of them: each vendor's connector reaches that vendor's own mail, and only Copilot reaches further, from inside new Outlook.

What the free connectors say

  • Claude, Microsoft 365NoS4

    Personal Microsoft accounts (such as @outlook.com or @hotmail.com addresses) can't be used to connect.

  • Claude for OutlookNoS7

    Exchange Online through Microsoft 365 is required.

  • Copilot in OutlookPartlyIn new Outlook, with a licenceS27 S25

    Microsoft extends it to Gmail, Yahoo and iCloud accounts added to new Outlook, under a licensed work account or a Microsoft 365 Personal, Family, Premium or Pro subscription, though not in classic Outlook for Windows. Its requirements page names Exchange Online.

  • Gemini in GmailNoS39

    Starting January 2027, Gmail will no longer support these features.

    Send as for other accounts, Gmailify and POP fetching on the web: the route for pulling other mail into Gmail is closing.

What Mailbox MCP does

It connects any mailbox that speaks IMAP: your own domain at a web host, Fastmail, Zoho, a cPanel server. Gmail connects by an app password, and Microsoft 365 by Microsoft's own sign-in, since a password can't open one.

A personal Outlook.com or Hotmail account, the kind Claude's Microsoft 365 connector refuses, takes the same Microsoft sign-in once IMAP is on: connect Claude to Hotmail or Outlook.com.

Every picture on this page is of a mailbox at a web host, reached over IMAP. The 2 below show what only an IMAP host shows you: it had no Archive folder until the AI archived something, and its junk folder was found by its role, though this webmail calls it Spam.

Set-up for each is on the IMAP, Gmail and Microsoft 365 pages.

An email connector for IMAP mailboxes that are not Gmail or Outlook: the robot plugging a glowing blue cable into a port on the side of a mailbox.
A mailbox at any host, by the protocol every mail client already uses
Webmail showing a new Archive folder holding the van booking from Calder Van Hire, still unread.
An Archive folder made on a host that had none, the booking in it and still unread
Webmail showing the Spam folder holding the parcel redelivery-fee message.
The parcel scam in the junk folder, found by its role though webmail names it Spam

Job 9: any AI

One mailbox connection for Claude, ChatGPT and any MCP client

Every free Gmail and Outlook connector lives inside its own assistant. Claude's Gmail connector is used from Claude, ChatGPT's Gmail connector from ChatGPT (OpenAI calls it an app, and the package it comes in a plugin), and Copilot from Outlook.

None of them states that the connection can be used from a different AI. That matters to anybody who uses more than one, and most people who ask this question do.

The server behind Claude's Gmail connector is Google's, and Google describes it as for "developers to build LLM applications". That's a developer preview, not something you connect.

Mailbox MCP is a standard remote MCP server, so the same mailbox connects to Claude, to ChatGPT and to any client that speaks the protocol. Each connection has its own permission level, which is what this picture from the control panel shows.

It's used from ChatGPT, not just listed for it: on 17 September 2026 an Outlook contact was created, corrected and deleted from ChatGPT through it, each step checked in Outlook before the next. The set-up for each client is on works with.

The control panel card "Your connections to this mailbox" showing 2 clients on one mailbox: a desktop MCP client at Read only, and Claude on a laptop at Draft and file with the calendar.
One mailbox, 2 AI clients, each with its own level

Job 10: several accounts

Several email accounts in one Claude or ChatGPT chat

Mailbox MCP gives each mailbox a connector of its own, so several mailboxes in one chat are several connectors. The mailbox is fixed when the connector signs in, which means the AI never picks an account by name and can't send from the wrong one.

We tested it in both on 6 October 2026. In Claude, one read-only question with 2 Mailbox MCP connectors switched on came back with an answer from each, saying which it used. In ChatGPT, one chat read the newest email in 2 of our mailboxes through the plugin, one connected account each. Multiple email accounts in Claude and ChatGPT has the steps and how to name each connector.

What the free connectors say

  • Claude, GmailNoS1

    Claude can only access the Gmail, Calendar, and Drive data for the Google account you've connected.

  • ChatGPT, GmailYesS13

    You can now connect multiple accounts for Gmail, Google Calendar, and Google Contacts plugins in ChatGPT, bringing your personal and work accounts into the same conversation.

  • ChatGPT, OutlookPartlyWhere supportedS14

    Adding another Microsoft account, where supported, creates another app connection.

These 3 sentences were read between 4 and 6 October 2026, after the rest of the table.

Several email accounts in one Claude chat: an answer headed Used BSolveIT Gmail, used Mailbox MCP Demo (routines test), listing invoice KS-1182 under the demo mailbox and the forwarded copy under the Gmail account, whose address is blurred, and saying nothing was opened, moved or marked as read.
One question, 2 Mailbox MCP connectors, one answer, 6 October 2026. The Gmail address is blurred.

Job 11: diary and address book

Calendar and contacts beside the mail

Mailbox MCP adds a diary and an address book to any mailbox, not only to the one its vendor made:

  • the calendar is Microsoft 365's with the same sign-in as the mail, Google's by a Google sign-in of its own, or any CalDAV server by its address;
  • the address book is Outlook's, Google's (open to everybody since 24 September 2026, the day Google verified it), or any CardDAV book.

The free connectors work the calendar that comes with the mail they connect to, and Claude for Outlook drafts invites. Contacts are thinner: ChatGPT's Outlook app reads and writes Outlook contacts, its Google apps read Google Contacts, and Anthropic's Microsoft 365 tool list has no contacts tool in it.

Nothing about a contact is stored here: a card is held in memory for about 10 minutes and forgotten. Which diary needs which route is in the guide to connecting a calendar.

A calendar and an address book beside the mail: the robot holding up a contact card and a calendar page, a glowing cable running from each of them and from the mailbox beside him into one screen.
A diary and an address book, on whichever mailbox you have
The control panel calendar card: connected to a CalDAV calendar on calendar.stackmail.com, with the calendar tools that server supports listed as chips.
A CalDAV diary on a web host, asked what it supports rather than assumed
The control panel address book card: connected to a CardDAV address book that can be written to, with read, create, update, delete and import listed.
A CardDAV address book, with what it allows the AI to do

Job 12: control

Control: read only, drafts only, or send, with approval and a record

Every vendor has an answer to "will it send without asking", and they are different kinds of answer.

What the free connectors say

  • Claude for OutlookYesNever sendsS7

    Claude never sends mail or invites on its own. The add-in does not request the Mail.Send permission.

  • Claude, Microsoft 365YesRead only by defaultS4

    Permissions are read-only by default. Claude can only send, create, or update content if you enable write tools.

  • Claude, GmailPartlyAsks first, by defaultS1

    On Team and Enterprise plans, owners decide whether members can allow these actions to run without asking each time.

  • ChatGPTPartlyMay ask firstS50

    An action may require additional review when it can affect another service, expose sensitive information, or be difficult to undo.

The add-in's answer names a permission that was never requested, which you can check on the consent screen yourself. The others are promises the assistant keeps, and a policy can change.

Bruce Schneier, writing about an attack that went through one of these connectors, explained why that difference matters:

We have zero agentic AI systems that are secure against these attacks.

Bruce Schneier, We Are Still Unable to Secure LLMs from Malicious Inputs, 27 August 2025

If the AI can be talked into something by a message it reads, then the control that counts is one the AI can't talk its way past. That's why control here sits in the server, not in the assistant.

  • Every connection carries a level, Read only, Draft and file or Send and delete, and a connection below send is never shown a sending tool at all.
  • The mailbox carries a limit of its own, which no connection or pasted token can exceed. The server checks both on every call.
  • On a shared mailbox with Team Access, a colleague's draft can wait for the owner's approval before it goes.
  • Every call is on the Activity tab: the tool, the time and the outcome, never the contents.

The whole of it is set out under permission levels and on the security page, and what isn't solved is in the threat model.

Email connector permissions, read only, drafts only or send: the robot padlocking a mailbox and giving a thumbs up.
A limit the server keeps, whatever the AI is told
The control panel card "The most any AI client may do with this mailbox", with Send and delete, Draft and file (selected) and Read only, and a switch for the calendar.
The mailbox limit: no connection can go above it
The control panel Activity table listing every call on a mailbox: when, which tool, who, the outcome and how long it took, with a note that no subjects, recipients or message content are logged.
Every call on the Activity tab, and none of the contents

Connect a mailbox at Read only first if you would rather watch it work before it writes anything. The free tier is 5 calls a day with no card.

Connect a mailbox Sign in

Read both halves

Where the vendors' own pages contradict themselves

Worth knowing if you're working out what your own connector does. You'll find one half of each of these, and it won't look like a contradiction until you've seen the other. Every one is on the vendors' own sites, read on 1 October 2026.

  • Anthropic

    Can Claude's Gmail connector send email?

    Help centre

    "Send, reply to, and forward emails from Gmail."

    S1

    Developer documentation

    "Claude reads and searches email only; it can't create, send, or modify messages."

    S43

    The same connector, described by 2 of Anthropic's own pages. The help centre also says it is "available for all users", where the developer page says Pro, Max, Team and Enterprise.

  • Google

    Can the Gmail server draft an email with an attachment?

    The tool's description

    "Limitation: Creating drafts with attachments is not supported yet."

    S46

    The same tool's input field

    "Optional. The attachments to include in the email. The combined size of attachments in the message cannot exceed 25MB."

    S46

    One page, a few lines apart. The table takes the limitation, because it is the sentence a reader can hold Google to.

  • Anthropic and Google

    How many tools does the Gmail server have?

    Anthropic's connector listing

    29 tools named

    S2

    Google's own reference

    11 tools documented

    S3

    One server, 2 lists. Google's pages for send_message, update_draft, reply, forward and trash_message answered 404, so for 18 of the tools the only published words are their names.

  • Microsoft

    Which mailboxes does Copilot in Outlook work on?

    FAQ, August 2026

    "Copilot scenarios in Outlook are only available on a user's primary mailbox. They are not available on a user's archive mailbox, group mailboxes, or shared and delegate mailboxes that they have access to."

    S20

    Requirements, 30 September 2026

    "Copilot can also use content that a user is permitted to access in archive, shared, and delegate mailboxes."

    S25

    The newer page is the better guide. The older one is still published.

  • OpenAI

    Can ChatGPT write to your own Outlook mailbox?

    The Outlook app's own list

    No tool that writes a message to the signed-in mailbox.

    S14

    Release notes

    ChatGPT can "draft and send emails" from a connected Outlook account.

    S13

    The app's list of what it can do, against the release notes for the same feature.

None of this is bad faith

These are large products, documented by different teams at different times, and mail features have moved monthly all year. It does mean the reliable way to learn what your connector does is to try it on a message you don't mind losing.

Before you connect

What Mailbox MCP does not do, and what it needs

Here's what Mailbox MCP doesn't do, and what it needs from you, before you connect a mailbox. All of it is in one place, so nothing turns up later.

What Mailbox MCP does not do: the robot pointing openly at an empty open mailbox with a stack of papers beneath it.
The limits, pointed at rather than left for you to find
  • It isn't free past 5 calls a day.

    Pro is £2.92 a month per mailbox, paid annually at £34.99 + VAT, for 1,000 calls a day, as the pricing page sets out.

  • Nothing runs without your AI.

    Mailbox MCP acts only when your AI calls it, in a chat or in a routine your own Claude or ChatGPT runs on a schedule.

    There are no rules and no new-mail alerts on our server.

  • One connector opens one mailbox.

    So 3 mailboxes are 3 connectors, each signed in on its own and each with its own permission level.

  • Gmail connects by an app password.

    That needs 2-Step Verification on the Google account, with a phone or an authenticator app. An app password can be withdrawn on its own and never touches your Google password.

    Google Calendar and Google contacts connect through Google's own sign-in.

  • It doesn't hold a send-later.

    Nothing waits on our server to go out at a set time. Your AI can send a draft at that time from a scheduled task of its own.

  • It doesn't send Bcc.

    For the reason in the Cc section: sent the obvious way, the copy in your Sent folder would carry the blind-copy list.

  • It edits only a draft marked as one.

    The webmail these pictures come from doesn't mark its drafts, so a draft written there is left alone rather than replaced.

  • It keeps no files and scans none.

    It doesn't lift a file out of a message to keep on its own, and it doesn't scan attachments for malware. The threat model says so in as many words.

  • Every competitor cell is what a vendor publishes.

    It isn't a test we ran on their product. We didn't drive 7 other connectors against a mailbox. What we did test is our own column, and the pictures are of that.

Connect Gmail

An app password, the one setting that hides it, and Google contacts and calendar beside the mail.

Connect Microsoft 365

One Microsoft sign-in, the permissions it asks for, and the calendar and Outlook contacts that come with it.

Connect any IMAP mailbox

Your own domain at a web host, Fastmail, Zoho or anything else: the host, the port and a password.

Questions

Questions people ask about the free email connectors

Can Claude's own Gmail and Outlook connectors read attachments?

It depends which one. Anthropic says its Gmail connector reads attachment metadata, not attachment content. Claude for Outlook, the add-in, reads .docx and .xlsx attachments inline and says PDFs are not read. Anthropic's Microsoft 365 connector doesn't say either way. Through Mailbox MCP, Claude reads a PDF, Word document, spreadsheet or slide deck as text, and a photo or scanned page as a picture, on Gmail, Microsoft 365 or any IMAP mailbox, without marking the message read.

Can ChatGPT's own Gmail and Outlook apps attach a file to an email?

OpenAI says ChatGPT can draft and send email from a connected Gmail or Outlook account. None of the OpenAI pages we read on 1 October 2026 says whether a file can go with it. Through Mailbox MCP, ChatGPT can attach a file in the mailbox, one at a web address, one from your computer by upload link, an image it has just made in the chat, or a small file it wrote, up to 20 MB a message.

Can Claude's own mail connectors send an email with an attachment?

Not through its built-in mail connectors, going by what Anthropic and Google publish. Anthropic's Microsoft 365 connector rejects any send, forward or draft that carries an attachment. Google says drafts with attachments are not supported yet on the Gmail server behind Claude's connector, and Claude for Outlook never sends. Through Mailbox MCP, Claude attaches a file from the mailbox, a web address or an upload link, or a small file it wrote, up to 20 MB a message.

Does Claude reply in the same email thread?

Anthropic says its Gmail connector can send, reply to and forward email, asking for your approval first by default, and its Microsoft 365 connector drafts a reply and then sends it. Neither says which threading headers the reply carries. Mailbox MCP sets In-Reply-To and References on every reply, takes the recipients from the original message rather than the AI, and marks the original answered, so the reply sits in the conversation.

Does reading an email through an AI connector mark it as read?

No vendor says. We searched every page behind this comparison, for Claude, ChatGPT, Copilot and Gemini, on 30 August, 24 September and 1 October 2026, and none states what an ordinary read does to a message's read state. Through Mailbox MCP, reading never marks a message read; marking one read is a separate tool that runs only when you ask. The inbox pictures on this page show it.

Can the free connectors reach a mailbox that is not Gmail or Outlook?

Not as documented. Claude's connectors reach a Google account or a Microsoft Entra work tenant, Claude for Outlook needs Exchange Online, Gemini reaches Gmail, and OpenAI names no host beyond Gmail and Outlook. Copilot reaches other accounts added to new Outlook, Gmail, Yahoo and iCloud among them, under a licensed work account or a Microsoft 365 Personal, Family, Premium or Pro subscription, but not in classic Outlook for Windows. Mailbox MCP connects any IMAP mailbox.

Why does Mailbox MCP not send Bcc?

Because the obvious way to send a blind copy, through a server that keeps the message in Sent, leaks. Built naively, the copy filed in your Sent folder carries the blind-copy list for anybody who opens it, and the people on it may receive nothing. So the server refuses a Bcc on every send path, and won't send a draft that carries one. Cc works everywhere. Send a Bcc from your own mail client.

What does Mailbox MCP do that the free connectors don't?

It does the jobs the free connectors stop short of: sending and reading attachments, forwarding with the files, filing without marking anything read, and working a mailbox that isn't Gmail or Outlook. The same connection works in Claude, ChatGPT and any MCP client, each at its own permission level. Every job is shown on this page in a real mail client. Free is 5 calls a day with no card; Pro is 1,000 a day per mailbox.

Attribution

Sources

Every competitor cell and quotation above rests on one of these, each read on . The S numbers are those of our research record, which also holds the earlier readings of 30 August, 12 September and 24 September 2026.

OpenAI's help centre refuses automated reading, so its pages were read in a browser. Our own column comes from the server's code, and from the jobs done on this page against a real mailbox on .

  1. S1 Anthropic: use Google Workspace connectors What Claude's Gmail connector does: send, reply and forward with approval by default, attachment metadata and not content, the one connected Google account, retention with the chat.
  2. S2 Anthropic: the Gmail connector listing "Made by Google", the connector URL gmailmcp.googleapis.com, and the 29 tool names, published as names without descriptions.
  3. S3 Google: Gmail MCP server reference Developer Preview; documents 11 of the tools. The per-tool pages for send_message, update_draft, reply, forward and trash_message answered 404.
  4. S4 Anthropic: set up the Microsoft 365 connector The Entra tenant requirement, no personal accounts, read-only by default, and attachments refused by every write tool.
  5. S6 Anthropic: Microsoft 365 connector security guide The published tool list: send, forward, drafts, reply and reply-all drafts, editing and deleting a draft, trash and restore, batch delete, categories, inbox rules and an out-of-office reply, and no move, flag, mark-read or contacts tool. "Always allow" not supported for sends.
  6. S7 Anthropic: Claude for Outlook Never sends; drafts land unsent in the compose pane; reads .docx and .xlsx and not PDF; archive, move and flag; Exchange Online required; the prompt injection sentence.
  7. S11 OpenAI: Google app data controls FAQ The gmail.modify scope, read-only Google Contacts, and no training on data from connected Google apps. Read in a browser; the help centre refuses automated fetches.
  8. S13 OpenAI: ChatGPT release notes ChatGPT drafts and sends from a connected Gmail or Outlook, on the web, on Plus, Pro, Business and Enterprise. Read in a browser.
  9. S14 OpenAI: Outlook email and calendar apps in ChatGPT What the Outlook app does: no message writes for your own mailbox, move and mark read on shared or delegated ones, attachments from your own mailbox only, Outlook contacts read and written. Read in a browser.
  10. S20 Microsoft: Copilot in Outlook FAQ Drafting and scheduling, and "only available on a user's primary mailbox" (last updated August 2026).
  11. S23 Microsoft: triage email with Copilot in Outlook Flag, mark read or unread, archive, delete, move, copy, junk, categories and folders, with a confirmation card above 5 emails.
  12. S24 Microsoft: draft an email with Copilot in Outlook The draft ends with a person selecting Send; selected text can be rewritten.
  13. S25 Microsoft: Microsoft Copilot requirements Primary mailboxes in Exchange Online, and content a user may open in archive, shared and delegate mailboxes (page dated 30 September 2026, moved and retitled when Microsoft 365 Copilot was renamed Microsoft Copilot); group mailboxes excluded.
  14. S27 Microsoft: Copilot for other accounts in new Outlook Gmail, Yahoo, iCloud and other accounts in new Outlook, under a licensed work account or a Microsoft 365 Personal, Family, Premium or Pro subscription; not in classic Outlook for Windows.
  15. S39 Google: changes to third-party accounts in Gmail Send as, Gmailify and POP on the web end in January 2027; IMAP and POP stay for other apps.
  16. S43 Anthropic: Gmail connector developer documentation "Claude reads and searches email only; it can't create, send, or modify messages." and "It's available on Pro, Max, Team, and Enterprise plans."
  17. S45 Google: collaborate with Gemini in Gmail Draft and refine; archive, delete, label, mark read or unread and star on an eligible plan, each confirmed; no new labels, no bulk spam.
  18. S46 Google: the create_draft tool Replies by replyToMessageId, Cc and Bcc fields, and "Creating drafts with attachments is not supported yet" beside an attachments field.
  19. S47 Google: the get_message tool Reads a message and "attachment metadata".
  20. S48 Google: the unlabel_message tool System labels INBOX, UNREAD and STARRED, which is how archiving, marking read and starring are done.
  21. S50 OpenAI: managing app permissions in ChatGPT Sending an email is an action that "may require additional review". Read in a browser.
  22. S51 OpenAI: connecting and managing app accounts Read for which mail hosts can be connected; names none beyond the vendors' own. Read in a browser.
  23. S52 Microsoft: summarise an email thread with Copilot In new Outlook and in Outlook on the web, PDF, PowerPoint and Word attachments can be summarised.
  24. Q1 Simon Willison: the lethal trifecta for AI agents The quotation in the attachments section, 16 June 2025.
  25. Q2 Bruce Schneier: We Are Still Unable to Secure LLMs from Malicious Inputs The quotation in the control section, 27 August 2025, written about a prompt injection through a ChatGPT connector.