The free Gmail and Outlook connectors, compared job by job.

Can Claude or ChatGPT reply in the same email thread?

A reply that lands as a loose message beside the conversation, rather than inside it, is the first thing people notice about a mail tool that was built for a demonstration. Whether it lands inside depends on two headers, In-Reply-To and References, that the reply has to carry.

Not one of them says which headers the reply carries. Google's create_draft tool asks for the original message's ID when a draft is a reply, which is the right input, and stops there.

What Mailbox MCP does

The reply tool builds In-Reply-To and References from the message it is answering, takes the recipients from that message (its Reply-To, otherwise its sender) rather than from anything the AI types, and refuses when a Reply-To points somewhere the message did not come from until the AI names that address. Reply-all keeps the original Cc and takes your own addresses out. The original is marked answered, which is the reply arrow in Outlook, and the Sent copy is filed once. We checked the threading in Outlook when it was built; below, the same reply sits under the quote it answers in webmail.

Can Claude read email attachments? What each connector opens

"What does this invoice come to" is a question about the file, not the email, and plenty of invoices arrive in an email that says only "please find attached". This is the row where the free email connectors have moved most, and the answer now depends on which one you have.

What Mailbox MCP does

The server opens the file and hands the AI what is in it: a PDF, a Word document, a spreadsheet (one block per sheet, formulas computed) or a slide deck as text, and a photo, or a scanned page with no text on it, as a picture, so a signed letter is read the way you would read it. It works out what a file is from its bytes, not from what it claims to be, and a program, a script or a macro-enabled document is named as a hazard rather than opened. Each file is read in a process of its own with a memory ceiling and a clock, nothing is kept afterwards, and reading a file does not mark the message read. Every attachment also comes back with a download link that streams it straight from your mail server for 15 minutes, so the AI can put the file itself in front of you.

That is further than any free connector publishes. The widest reading among the 7 is Word and Excel in Claude for Outlook, and a summary of a PDF, PowerPoint or Word file from Copilot in new Outlook. None of them says it works out a spreadsheet's formulas, goes through a deck slide by slide or reads a scanned page as a picture, and Claude's Gmail connector reads an attachment's metadata and not what is in it.

Simon Willison, who named the risk the rest of this section answers, put the email half of it bluntly:

Something as simple as a tool that can access your email? That's a perfect source of untrusted content: an attacker can literally email your LLM and tell it what to do!

Simon Willison, The lethal trifecta for AI agents, 16 June 2025

An attachment is that sentence one level deeper. Its name, its declared type and every word inside it were chosen by whoever sent it, which is why this server decides what a file is by its bytes, reads it where a hostile file can only take down its own process, and fences what it found as content rather than instruction before the AI sees it. None of the free connectors that read attachments describes doing any of that, though Anthropic's add-in page does say the thing that matters, in a sentence worth quoting in full: "Email bodies and attachments are untrusted input and may contain instructions intended to manipulate Claude rather than you."

Cc on an email the AI sends, and why Bcc is refused

Copying a colleague in is the smallest job on this page, and the vendors say almost nothing about it.

What Mailbox MCP does

Cc works on every send, reply, forward and draft, and a reply-all keeps the original Cc as it was. Bcc is refused, on every path, on purpose. A blind copy is not a Cc with one more name: sent the obvious way, through a server that keeps the message in Sent, the copy filed in your Sent folder carries the blind-copy list for anybody who opens it later, and the people on the list can receive nothing at all. So the server refuses a Bcc, refuses to send a draft that carries one, and says to send that one from your own mail client. A tool that tells you what it will not do is one you can trust with the rest.

Filing email with AI: archive, move, junk, flag, and leaving it unread

Filing is where the free email connectors differ most, and where Microsoft's is strongest by some way.

And the question none of them answers: what an ordinary read does to the read flag. Ask an assistant to go through 80 unread messages and tell you which need you, and if reading sets the flag you have lost the only marker you had for what you have not looked at, with no undo for it.

What Mailbox MCP does

Archive goes to the provider's own archive: Microsoft 365's Archive folder, Gmail's All Mail with the Inbox label taken off, and on a mailbox that has none, a folder made for it the way Thunderbird's Archive button makes one. Junk and Trash are found by the folder's role, never by guessing its name. A move keeps the message's flags and its original date. Delete moves to Trash. A new folder is subscribed, so Outlook shows it. And reading never marks anything read: marking read is a separate tool that runs when you ask. In the first picture below, the AI has already read 4 of these messages, replied to 2 and forwarded 1, and every one is still unread.