Guide
What an email MCP server is, and what one can actually do.
MCP is a way for an AI client to call tools that somebody else wrote. Point it at a mail server and those tools read, write and file real messages in a real mailbox. Here is what that means in practice, tool by tool.
- Reading About 6 minutes
- Assumes No programming
- Spec read Revision 2026-07-28
The short version
An MCP server hands your AI client a list of tools. An email MCP server's tools happen to open your mailbox. Your client calls them when you ask for something that needs them, and nothing else in your mail setup changes.
New to the term MCP and would rather see what it changes before reading how it works? What an AI can actually do with your email covers the same ground without the protocol detail.
The protocol
What MCP actually is
The Model Context Protocol is a specification for how an AI client asks
another program to do something. That is the whole idea. One side offers a
list of named tools with typed arguments, the other side calls them. The
messages are JSON-RPC, and the specification is public and versioned: the
current revision is 2026-07-28, which is the one this page was
checked against.
The important consequence is that the protocol is not owned by any one AI company. A server that speaks it serves any client that speaks it. That is why this site talks about Claude, Cursor, Zed and VS Code in the same breath rather than picking one: from the server's side they are indistinguishable, because nothing in an MCP request says which assistant is on the other end.
There is no model inside an MCP server
This is the misunderstanding worth clearing up first, because everything else follows from it. An MCP server does not think, does not read your mail on its own, and does not decide anything. It sits there with a list of tools until something calls one. The intelligence is entirely on the client side; the server is the hands.
Why the distinction matters to you
It tells you where to look when something goes wrong, and who to ask about privacy. If your AI drafted a strange reply, that is the model. If the reply did not thread properly, that is the server. The two are different companies with different answers.
Applied to mail
What makes it an email MCP server
Nothing in the protocol knows what email is. An MCP server is a mail
server because its tools happen to be mail operations and because it holds
a connection to a mailbox: an IMAP session against your host, or an OAuth
token against Microsoft Graph. The protocol carries send_email
exactly the way it would carry a tool for querying a database.
Which means the interesting questions are never about MCP. They are about the mail side: does it thread a reply properly, does reading a message mark it read, does the sent copy land in Sent Items once or twice. A page that explains MCP beautifully and skips those has told you nothing about whether the thing works, which is why the tool surface and what the server does with your credentials get their own pages here.
Three ways the mailbox gets opened
Worth knowing because it decides your set-up, and because one of the three is not optional in the way people assume:
| Provider | How it connects | What you hand over |
|---|---|---|
| Gmail | IMAP and SMTP | An app password from your own Google Account, revocable on its own |
| Microsoft 365 | Microsoft Graph, over OAuth | One Microsoft sign-in. No password reaches us |
| Any IMAP host | IMAP and SMTP | Server names, ports and a password |
Microsoft 365 cannot use the first row even if you want it to. Microsoft disabled Basic Authentication for IMAP on 1 October 2022, so no client anywhere opens those mailboxes with a password. The Microsoft 365 guide covers what replaces it.
Tool surface
The 28 tools, and what each one does
This is the part no summary of the protocol can give you. A tool that is not on this list cannot be called, by any client, however it is asked. The list comes from the server's own registration code rather than from a marketing page, which is why it is twenty-eight and not a round number.
Read 6 tools
Search, open a thread, get a file back out
list_mailboxeslist_emailsread_emailread_threadsearch_emailsfind_contact
Send 6 tools
As any of your addresses, or as a real draft
draft_emaildraft_replydraft_forwardupdate_draftlist_identitiessend_email
Reply 1 tool
In thread, carrying the right headers
reply_email
Forward 1 tool
With everything the original carried
forward_email
File 6 tools
Move 500 at once, and take a file in
create_upload_linkcreate_foldermove_emaildelete_emailrename_folderdelete_folder
Flag 4 tools
Mark read, unread or flagged, on request
mark_readmark_unreadflag_emailunflag_email
Check 4 tools
Bounces, receipts, trust records, uploads
check_bouncescheck_deliverabilitycheck_uploadcheck_receipts
Read the verbs, not the count
Twenty-eight sounds like a lot until
you split it by what each one does to
your mailbox. Eleven only read, and nothing changes when they run.
Nine make a change you can undo: create_folder,
draft_email, mark_read,
mark_unread, flag_email,
unflag_email and create_upload_link.
Eight are the ones a host application stops
and asks about before running, and only three of those leave your
mailbox at all: send_email, reply_email and
forward_email. That split is not our labelling. It is
carried in the tool definitions themselves, which is how your AI client
knows when to ask you first.
The complete tool reference sets the twenty-eight out in that order, with the batch ceiling, the attachment ceiling and what each one refuses.
Twenty-eight tools is a list. Connecting a mailbox is how you find out what they do to yours, and the free tier covers it without a card.
Common mix-ups
What it is not
Four things people reasonably assume, none of which is true, and each one changes what you should expect.
It is not a mail client
There is no inbox to look at, no window, no interface at all. You keep using Outlook or Gmail exactly as you do now. The AI is a second way in, not a replacement, and the whole design goal is that you cannot tell from your mailbox that it was ever there.
It is not a rule, a filter, or a forwarding address
Nothing is added to your mail account. There is no rule sitting in Outlook quietly moving things, no auto-forward to a third-party domain, no app with standing permission acting while you are asleep. Every action happens because a tool call happened, and a tool call happens because you asked for something.
It is not an archive, a backup or a migration tool
It reads what is there and writes what you ask for. It does not keep a copy, and it cannot recover a message that has already gone. If you need a backup, you need a backup product.
It is not a way to give an AI standing access to everything
One connection is one mailbox. Shared and delegated mailboxes are not supported, so connecting your own account does not quietly expose the team's.
Measured
Where the boundary sits, measured
The line between "an AI that can describe your inbox" and "an AI that can work it" is not a feature list, it is whether the mailbox comes out the other side unchanged. Each row below was taken against a live mailbox rather than inferred from an API response.
- Reading a message Does not mark it read
- Replies In-Reply-To and References carried
- Copies filed per send 1, no duplicate
- Attachment bytes SHA-256 identical on arrival
- Read in one session 26,930 messages over IMAP
Every row in that table is checkable against your own mailbox in about two minutes.
Limits
What this guide does not tell you
-
Which clients qualify
It does not tell you whether any particular AI client supports remote MCP servers today. That changes month to month, so the works-with page explains the requirement instead of publishing a table that would be wrong by Christmas.
-
Building your own
It does not cover building your own server. The specification does that properly and this would do it badly.
-
Only this server's tools
It describes the tools this server registers. Another vendor's mail MCP server will have a different list, and the only way to know is to read theirs.
-
This dates quickly
Protocol details are accurate as at revision 2026-07-28. MCP has changed its transport arrangements twice already, and it will change again.
What is an MCP server?
An MCP server is a program that offers an AI client a list of named tools it can call, using the Model Context Protocol. It is not a chatbot and it has no model in it. It publishes the tools; the AI decides when to use one.
What can an AI actually do with my email?
With an email MCP server, exactly what its tool list says and nothing else. Ours registers twenty-eight tools covering reading, searching, sending, replying, forwarding, filing, flagging, choosing which of your addresses to send as, and checking whether what you sent actually arrived. There is nothing off that list it can quietly do, because a tool that is not registered cannot be called.
Is this a plugin, an app, or something else?
None of those. It is a server your AI client talks to over the network. Nothing is installed on your machine and nothing is added to your mailbox: no rule, no forwarding address, no app sitting in your Google or Microsoft account doing things while you sleep.
Does the AI company get a copy of my email?
Whatever passes through a tool call is in the conversation, so your AI client sees the messages you ask it to read, the same way it sees anything else you paste into it. What it does with that is governed by your agreement with them, not with us. We do not copy your messages into a database, because there is no database in the server.
Is an MCP server the same as a plugin?
It is close enough for a first explanation and wrong in one way that matters. A plugin usually runs inside the host application. An MCP server runs outside it, speaks a documented protocol, and can be used by any client that speaks the same protocol, so one server serves Claude, Cursor and anything else without being rewritten.
Do I need to be able to program to use one?
No. Setting up a remote MCP server is pasting a URL into your client's settings. The protocol detail matters to whoever builds the server, which is why this guide explains it rather than assuming it.
Attribution
Sources
- Model Context Protocol: Transports, revision 2026-07-28 The current specification. Read 2026-08-26 for the transport and message-format statements above.
- Model Context Protocol: Authorization How an HTTP-based MCP server authorises a client, and the bearer-token rules it must follow.
- Microsoft: Deprecation of Basic authentication in Exchange Online The primary source for password access to Microsoft 365 mailboxes ending on 1 October 2022.
Keep going
Read next
Try it on your own mailbox.
5 calls a day on any mailbox, free, no card. Enough to see the tools above working against your own mail before you decide whether the description was accurate.